what next please?

Help!

I too have been infected with the RCP virus thing.

I have installed MS's patch and have been to the symantec
address as specified earlier, but having followed their
instructions I can find no instance of either the worm or
cmd.exe anywhere.

HOWEVER

Looking at my event logs there was an instance when the
Security Access Manager was changed, and it says that any
changes to accounts (user id or password) will be passed
on to this new program. Also I keep seeing 'anonymous
user' log on/offs and also NT Authority/Local Service log
0n/offs.

Acting on poor advice during the stage when I could not
keep connected to the internet for longer than 45 seconds
I performed a system restore which is ill advised
according to the Symantec website and was wondering if
this has compounded the problem.

Sorry for the long-winded nature of this post; I thought
it best to outlay exactly what has happened so far.

Any advice would be greatly appreciated,

Regards,

Dave.