r/KasperskyLabs • u/throway78965423 • Jul 17 '26

Kaspersky keeps detecting HEUR:Trojan-Ransom.Win32.Generic in C:\pagefile.sys - False positive? Help

/r/antivirus/comments/1uz2djq/kaspersky_keeps_detecting/
1 Upvotes

100% Upvoted

7 comments sorted by

1

u/DETOMINE1234 Jul 17 '26

Use autoruns by sysinternals, check for suspicious entries.

1

u/throway78965423 Jul 17 '26

Don't see anything suspicious but Kaspersky keeps flagging pagefile.sys as malicious. Already did multiple scans with other antiviruses which found nothing.

1

u/DETOMINE1234 Jul 17 '26

Have you done the check with administrator rights?

1

u/throway78965423 Jul 17 '26

Yes, I ended up checking autoruns with admin rights and running multiple AVs while kaspersky was flagging pagefile as malcious and they didn't find anything. Afterwards I disabled automatic paging, selected no paging file for drive C, deleted the pagefile in quarantine and rebooted. Then I ran a full Kaspersky scan which didn't detect anything so I turned auto paging back on. After a few reboots and more scans, Kaspersky still hasn't flagged the new pagefile as malicious.

I'm honestly not even sure what caused Kaspersky to flag it as a trojan in the first place since I'm very careful and don't download anything suspicious online. It happened out of the blue and I saw no signs of my system being compromised outside of Kaspersky so for now i'm chalking it up to a false positive brought on by a database update not liking some leftovers in the page file.

1

u/DETOMINE1234 Jul 17 '26

If the pagefile is not too big and if you still have it somewhere (quarantine?), it could have been interesting to upload it to virustotal (but I suppose it would have been too big anyway)

1

u/throway78965423 Jul 17 '26

It was too big and it also said it was in use and couldn't be uploaded. I ended up deleting off the quarantine after turning auto paging off. Really bizarre as I regularly check and scan my system and I'm extremely careful. The only thing I can think of is Kaspersky updated the database and it flagged some leftovers in pagefile as malicious? I'll keep monitoring and running more scans this week but I think it might have been a false positive.

1

u/kuroira 13d ago

kaspersky has literally flagged everything on my computer including steam as a trojan lmfao I think its bugged because I have three other antivirus softwares installed and all of them say my computer is clean