StartPage.AMB aka Trojan.Win32.StartPage.jo

I run Windows XP. McAfee did not detect it. Panda gave the following location but did not identify the complete location.

c:/Documents and Settings/Owner

...when we started..We still need to know the name of the file and it's exact location..I'm asking because it may be a false positive. (Not really a virus/trojan at all.) There's no way to know till we know the specifics. By the path you've described, please delete all the files from within the Temporary Internet Files folder and the Temp folder which reside at C\Documents and Settings\Owner\Local Settings\Temp and Temporary Internet Files. After cleaning out those folders, then run another scan at Panda.

In addition, make sure to download, install, update, the run the Ewido program I recommended earlier while in Safe Mode.

Hope this helps and let us know what you find.

Grif

I ran panda again and stopped it as soon as the malware showed up. I was able to get the following info.

c:/Documents and Settings/owner/Favorites/Health

I believe one of the safeguards I've installed may have the name PC Health in it.

sheldon

..be deleted by opening Internet Explorer, then click on the "Favorites" menu in the upper left, then RIGHT click on the "Health" listing, choose "Delete".

That said, it seems strange that a website link would be detected as spyware/virus/trojan..As I suggested earlier, run scans with the other tools I suggested. If they don't find a problem, then you have some further information the detection is a false positive.

Then again, it won't hurt anything to the delete the "Favorites" link right off. It's your decision.

Hope this helps.

Grif

I agree-I don't think it's associated with a web page. I've done everything suggested so hopefully it's a false positive. I noted that it was created on 11/16/05. Is there a way to set the system back to before that date?

sheldon

Simply delete the Health shortcut from the Favorites location, then scan again. If you happen to have a "third party" "Health" program installed in your Add/Remove Programs, then uninstall it..If it's gone, then it's gone and nothing else needs to be done.

PCHealth is a program installed by many default Windows HP HOME systems and as such is legitimate..ON the other hand, if you've installed something from a third party vendor, then who knows what it might have placed in the "Favorites" section. Start by simply deleting the Favorites addition and run a scan again. There's no need to us System Restore unless required.

Hope this helps..

Grif

I've followed all instructions including deleting the Health folder from favorites and...viola...all's clean.

Thank You.

Sheldon