luhe lockscreen a

50Twuncle

onzey wrote: »

Possibly by googling

setup.res hstart.exe

The first link that comes up for me is an avast thread that mentions Ancestry 2012 in the first post

http://forum.avast.com/index.php?topic=97328.0

phew ... thanks !!
That explains why neither AGV or Malwarebytes picked anything up..........

waddler_8

21Twinkle wrote: »

Thanks - but (for future reference) - how did you know that it was family tree maker that caused the false positive ?

The ESET log gives you the filename, path to file & SHA1 hash value.

sh=728B0331B572EE396616BD8DBEF068396AFCBC00 ft=0 fh=0000000000000000 vn="a variant of Win32/HiddenStart.A application" ac=I fn="C:\ProgramData\{484395D8-1F9B-4C71-9DA9-A64CBD0E8DE2}\setup.res"

This gives you all you need to help uniquely identify the file. As onezy said, you can then cross reference that against software databases.

waddler_8 wrote: »

You need to say exactly what was detected

eg:

C:\directory\folder\sub folder\filename.ext

waddler_8 wrote: »

Once again, it's important exactly what was detected (Path/File).