Hi, i have managed to delete the files necessary to remove the msbalst worm virus and also removed it from the registery as suggested in previous posts. I have the patch to stop it coming back and have run the symantec worm remover program to check that it is definately gone.......... but i am still having alot of troubles with my computer since getting the virus. Some of the problems im having are: internet explorer keeps freezing up and needs shutting down, i cannot type anything into the address bar, when i do it just loads the '504 gateway timeout' page but if i copy and paste into the bar it works fine and if i click my favourites it also works. and also my floppy disk drive does not seem to be opperating correctly.... won't let me format disks etc it comes up with a message saying it 'cannot format this disk shut down any utilities that maybe using the drive then try again' and in general the computer is running like sh*t! Anyway just out of curiosity i ran the registery editor again and entered 'msblast.exe' into the find option and it found one more file in there with that name in: My Computer\HKEY_USERS\S-1-5-21-1292428093-842925246-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603 So can anybody tell me if this is supposed to be there or should it also be deleted? And does anyone have any suggestions about the other problems i'm having..... I am considering backing up all my files and just formatting my pc and starting again from scratch? is this probably my best option? i am a little worried that my recovery floppy will not work though because of the trouble i'm having with the drive........... Sorry for the long post. Thx in advance for the help Steve

go to system tools, try a system restore to an earlier date

Unfortunately i cannot restore to an earlier time because in the advise from symantec.com about this, they suggest you turn of the system restore funtion whilst you delete the virus and install the patch, otherwise when you install the patch it will copy the virus into the restore point so it is still lurking somewhere on your comp..... as a result of turning it off though, it deletes all your previous restore points so restoring to an earlier date is not possible. Thx for your input though...... any other ideas?? Steve

I cant help you, but was wondering if you can help me? I hace installed the patch, but dont know where to go from there, can you help?

Hi mike, i have sent you an email, but incase you don't receive it heres what i replyed: The easiest way to sort the problem is to use the worm removal tool available from symantec.com Here is the link to the page to download the tool: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html If you are unable to download the tool because the virus is disconnecting you from the net, then you need to follow procedure to change the actions of the RPC Services first. Go to Control Panel (use the classic view) Administration Tools Computer Management Services and Applicatons Services Double-Click on Remote procedure call (RPC) Choose "Recovery" Change all three selections to "Take No Action" After you have done this you should be able to stay online long enough to download the tool and read the info on the symantec site........ when you are all done you can go back and reverse the RPC procedure. Follow the advice there and you should be ok...... It's fairly simple virus to get rid of once you get around the problem of getting online! Steve

i need a patch for it

Anybody have any ideas on how to sort the problems with my comp?????? Steve