This particular virus came in on a phony Microsoft update message that claimed it was updating my computer. It's called W32.Sobig.B@mm and according to the folks at Norton, it is rare, but they didn't provide any more information other than that. The bug takes shelter in a compressed file which cannot be deleted or quarantined by Norton Antivirus. It resides in c:\_REstore\Archive\Fs348.cab and the file is listed as A0034650.CPY. There are six infected files and they are all in the same location, but no mater what I try, I havn't been able to eliminate them. I'm open to any and all suggestions. I have downloaded the latest Norten updates, which is something I do weekly on a routine basis, but this hasn't helped.

Thanks everyone,

Gary

Gary,
The other option you may have is to do a system restore. To see if you have that...
start>programs>accessories>system tools
See if system restore is there. If so pick a date prior to the virus and the o/s will take you back to what your pc looked like that day.

While we are on that subject...it's a good idea every once in awhile when all is ok, to go in and set a restore point in the same place. Again, it takes a snapshot of where the system is, should you ever need to restore it. Having done the fdisk shuffle a few times myself, I have gotten in the habit of doing that regularily to keep from having to do a total wipe out.
Terry

------------------
jam on,
Terry http://imjazzed.homestead.com/Index.html

[This message has been edited by trtjazz (edited 05-31-2003).]

Because they are in the Restore file, you cannot delete them as easily. You can do it through DOS though.
Also, there is an easier way.
The Restore files are used in Windows ME and XP to restore your computer to an earlier point in time, and the computer automatically makes a copy of everything.
You must TURN OFF the Restore facility, then reboot the computer. This (I'm speaking from memory) empties the entire Restore Directory. The virus files, along with all the others in that directory will be gone.
Then, remember to reenable the Restore facility.
You can find exact directions by searching the web site "Deja".
DonM

P.S. Remember the virus files in Restore are only a copy. The files will also be elsewhere in your computer. I think that Symantics now has a program to find and eliminate the virus you have, according to their latest newsletter.

They say they have a removal tool .. http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.b@mm.html

also ... good info at http://www.itc.virginia.edu/desktop/virus/fixes.php3?fixID=74&virusID=64

Hugh,
I tried this one ..... got my fingers crossed ! Thanx !

Well...... it's been more than 10 minutes since I did the "fix" and so far .... NO POP UPS !

YIPPIE !!!!!!!!!!

Hugh,

Thank you, thank you, thank you! The fix program nailed the little bugger and wiped it out. Ironically, just as I logged on, the same nasty virus popped up, but it was immediately deleted.

Thanks again for all your help,

Gary

Dave -- your welcome.
Gary -- your welcome, welcome, welcome.

Boy, do I feel useful and helpful. Maybe I will go mop the floor ... nah, done enough for one day :-)

Hugh

Hugh,
Take the rest of the day off ! Relax .... you have put out enough fires for one day !