SysRESTORE should probably be disabled, yes… Forgot about this nice XP-feature :slight_smile:

P.S.: imho if the detected Startpage-006 would be in sysRESTORE, then avast shield should alert to this, but maybe some other stuff in the HJT-Log is recreating this…

I’m quite sure RAMAN had posted quite good instructions to clean startpage-006, but I’m too lazy too search (it’s late… :wink: )