Avast WEBforum

Other => Viruses and worms => Topic started by: sonny082006 on March 31, 2007, 08:46:31 AM

Title: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: sonny082006 on March 31, 2007, 08:46:31 AM
Good day,for the past 3 days my pc always "stop" & blue screen mesages prompt "KERNEL STACK INPAGE ERROR...begining to dump physical memory..." and some beeps were sounding in my cpu until it continues to beep. Sometimes I'm  unable to boot in my hardisk but with the help  of  rescue disk it can boot again... then restart my pc but it slow my pc and connections so i download bitdefender because AVG & avg antispyware can't see the virus even  spybot,adaware & bitdefender...until i update my Avast and scan both c; & d: under win98=c: (d:=XP).My question is why both filename pagefile.sys in C: & d: were infected by 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring, which seems Avast didn't really deleted the virus because everytime I boot it is always there.
Is it Possible that it has other remnants the stated virus? Where can I find the cure ?Pls post some info with these 2 virus which is in my pc and how to prevent and other cure for d virus.thanks and best regards...
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE
Post by: FreewheelinFrank on March 31, 2007, 09:53:54 AM
Hi sonny082006,

If you have AVG Anti-Virus, Bitdefender and avast! installed on your computer, they will conflict and cause serious stability problems.

You must have only one AV installed. Having three installed at the same time may well be the source of you instability problems.

The detection in pagefile.sys may well be a false positive:

http://forum.avast.com/index.php?topic=26157.0 (http://forum.avast.com/index.php?topic=26157.0)

http://forum.avast.com/index.php?topic=12372.msg104379#msg104379 (http://forum.avast.com/index.php?topic=12372.msg104379#msg104379)

The pagefile.sys file is just the computer's virtual memory: RAM written to disk. It is not reloaded after a boot. To check for malware active in memory, do a memory scan with avast! (just start the scanner- the memory scan is run automatically), AVG Anti-Spyware or alternatively a-Squared:

http://www.emsisoft.com/en/software/free/ (http://www.emsisoft.com/en/software/free/)
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: sonny082006 on March 31, 2007, 10:49:41 AM
...thanks for prompt reply free...i've downloaded spysweeper 5.0 my question is , is it effective and freeware? if not i won't extract the exe file anymore because my protection software would be many and i dont want to cuase some conflict on my pc.Again thank you very much...
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE
Post by: FreewheelinFrank on March 31, 2007, 11:48:13 AM
Effective? Yes Freeware? No.

You should have one AV and (optionally) one anti-spyware with real-time protection.

You can have several anti-spyware scanners, e.g., Spybot Search & Destroy, Ad-Aware free, Avg Anti-Spyware  free, a-squared free.

If you want real-time anti-spyware protection, the free options are Windows Defender (poor detection) or Spyware Terminator.

The paid options (better detection rates) are Spysweeper, SpywareDoctor or CounterSpy.

Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE
Post by: DavidR on March 31, 2007, 02:56:49 PM
A google search for the kernel problem returns many hits, http://www.google.com/search?q=KERNEL+STACK+INPAGE+ERROR (http://www.google.com/search?q=KERNEL+STACK+INPAGE+ERROR)... As Frank said though any instability could be caused by multiple resident AVs installed.

If you are using Bitdefender free, then that should be OK as an on-demand scanner, just pause the Standard Shield before starting another security scan.

It is possible to exclude the pagefile.sys from scans (I have, ?:/pagefile.sys the ? excludes the file in different drives, see image), I though that it was by default possibly not. You could also add it to, Program Settings, Exclusions for on-demand scans.
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: mauserme on March 31, 2007, 03:05:04 PM
Another approach would be to turn off the page file, reboot, turn the page file back on and boot again.  You may need to do this for both partitions unless you're sharing the pagefile between them.

But as FwFrank and DavidR, remove AVG Antivirus first.


EDIT:  The pagefile might be called the swapfile under Windows 98 (I don't remember which).
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE
Post by: FreewheelinFrank on March 31, 2007, 03:25:06 PM
Quote
If you are using Bitdefender free, then that should be OK as an on-demand scanner, just pause the Standard Shield before starting another security scan.

Last time I tried, even this caused major problems. Mind you, that was probably a year or so ago now.

I think Bitdefender 8 worked OK with avast! but 9 caused problems: the problems certainly started after a version upgrade.

Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: mauserme on March 31, 2007, 04:05:54 PM
I think v9 was a resident av.  Maybe you had an evaluation copy?

The current free version is still 8

http://www.bitdefender.com/site/Main/view/Download-Free-Products.html
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: FreewheelinFrank on March 31, 2007, 04:35:35 PM
Maybe I'm thinking of 7 to 8, but neither was resident.
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: sonny082006 on April 01, 2007, 05:47:23 PM
...thanks for all reply, now i think that my downloaded bitdefender(free) is the cause because when i run it under safemode in XP an error on virus shield was reflected...now i'm thinking of deleting either bitdefender in my XP or stick to AVG,while on my windows 98 still dedicated to Avast.Thanks a lot and also for not deleting my old account...
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: sonny082006 on April 03, 2007, 05:47:32 PM
Quote
Another approach would be to turn off the page file, reboot, turn the page file back on and boot again.  You may need to do this for both partitions unless you're sharing the pagefile between them.
...may I ask how to do this...turn off the pagefile?
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: Lisandro on April 03, 2007, 07:32:41 PM
...may I ask how to do this...turn off the pagefile?
On Windows XP you can go Control Panel > System > Advanced > Performance.
Title: Re: 'saturday 14th-669' and 'whiplash 4592-b'? Also it is recurring in PAGEFILE.SYS
Post by: mauserme on April 03, 2007, 08:55:20 PM
...may I ask how to do this...turn off the pagefile?
On Windows XP you can go Control Panel > System > Advanced > Performance.
Yes, but first notate your settings so you can recreate them when you turn the page file back on. 

After turning paging off and prior to turning it on again rename C:\pagefile.sys to C:\pagefile.old.  The .sys version should be recreated when you turn paging back on.  If that all goes as expected pagefile.old can then be deleted.

Note:  You may need to change your folder options to Show Hidden Files and Folders in order to see pagefile.sys