Troj_Anakha.a in c:\_restore

[rshd301]

I ran a check recently and discovered the virus Troj_Anakha.a located in c:\_restore\archive\fsb.cab. PC-Cillin, Moosoft etc have been unable to clean or delete this virus for me.

The folder is a hidden folder which might explain why the file can't be deleted but I don't know.

Can anyone advise as to how to clear this virus?

 

[TonyKlein]

Asuming you're running Windows ME, do this:

1. Close all open programs.
2. Right-click My Computer on the Windows desktop, and then click Properties.
3. Click the Performance tab.
4. Click File System.
5. Click the Troubleshooting tab.
6. Check Disable System Restore, click OK, and then click Close.
7. Click Yes to restart. This disables the System Restore feature and will purge the contents of the _RESTORE folder, including your virus, when the system is restarted.

Good luck,

 

[rshd301]

Thankyou Tony,

Did as you suggested, ran PC-Cillin again and discovered 4 more in Power Quest Second Chance. Uninstalled and reinstalled and I am now clean.

Thanks again.

P.S. Do I really need both ME system restore and Second Chance? Surely they do the same job! I have not enabled ME system restore after your advice, should I?

 

[TonyKlein]

I'm not running Windows ME myself, but from what I understand System Restore is automatically reenabled on reboot.

And I think you probably don't need Second Chance on top of that.

Here's some reading:

Description of the System Restore Utility in Windows Millennium Edition

Windows Me System Restore

Good luck,