On Thu, 13 Jan 2005 08:44:57 +0700, Amos D. Galiardo <amdix@xxxxxxxxxx> wrote: > http://www.MSExchange.org/ > > Thank you, i will try to look at mlin.net first... Run the MBSA (first link provided). > i use trendmicro too, and i'm scanning....i set delete on norton when found > the virus, i think when norton found that virus that worm run first ...so > the server was infected.... The root of the problem is a vulnerability that the virus keeps on exploiting, so fix that first - by patching windows - then cleanup the rest of your systems. ...D