I have downloaded and run the symantec tool to remove the worm. I have checked the registry and do not find it there and I have removed it from win.ini yet when I reboot the computer it comes up that it can't find the srcsvr.exe file. Where might it be hiding? anyone have any suggestions?

It wud be better if u post the same question in the security and virus forum.

rick, The below solution is from Muk1wa on Pg 4 of the thread at the link below. http://discussions.virtualdr.com/showthread.php?s=&threadid=119374&pagenumber=4 I HAVE DEFINITELY GOT RID OF IT!!!!! Go to your internet settings, then the properties of your tcp/ip protocol and disable the 'Client for Microsoft Networks' & 'File and printer sharing for Microsoft Networks' bindings. I am on a 2 machine network with a shared 'c' drive on one machine (the one with the problem). I can still access my shared c drive and my printer! For 3 hours i have been scrsvr.exe free and my win.ini file is untouched. For more info see http://grc.com/su-bondage.htm YIPPEEEEEE!!!!!! HTH Tufenuf

3 places *ScrSVR.EXE* hides are: 1. C:\Win.ini in the [Windows] section in the Run="C:\Windows\ScrSvr.exe" 2. In C:\Windows\ScrSVR.exe 3. In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run After you click *Run* from the above in the LEFT Panel, look in the RIGHT panel for *ScrSVR* in first column and "C:\Windows\ScrSVR.exe" in the second column. In your removal Start with the Registry> Win.Ini >Windows Explorer 1. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Right click *ScrSVR* > Delete 2. Find *Win.ini* in *C:* drive [ as C:Windows\Win.ini] 3. Open *Win.ini* in *Notepad* and look under [Windows] for Run="C:\Windows\ScrSvr.exe" 4. Delete "C:\Windows\ScrSvr.exe" 5. Open Windows Explorer and find "C:\Windows\ScrSvr.exe" Right click *ScrSvr.exe* and delete. Run Virus Scan with latest Virus Definitions. Shut down areas of network vulnarabilities. M

Thanks folks, I followed your lead and it seems to have got rid of the thing. rick

Good for you. But don't declare victory too soon in the battle against this Worm!!! Be vigilant. I would even recommend checking *C:\Windows* for *SCRSVR.EXE* using *Find> File* method, after making sure *Folder View* [Start>Programs Windows Explorer> View> Folder Options...> View tab> Hidden Folder section> Radio buttons] has radio button of *Show all Files* bubbled. If found, you can delete it ONLY in *MS.DOS Mode* 1. Start>Shut Down...>Restart in MS DOS Mode>OK. 2. At C:\Windows>, type Del ScrSvr.exe and press ENTER. 3. Restart Windows pressing ALT+CTRL+Delete Now ScrSvr.exe will be gone from C:\Windows. M

thanks madhuriMN your fix worked great