On Tue, 7 Aug 2001, Austad, Jay wrote: > Or something similar. You'd probably need something in there to remove the > worm also, because the patch won't remove the worm from the system. You already did: > Lynx -source http://infectedhost/scripts/root.exe+/c+reboot IIRC the worm doesn't ever store itself on disk. It seems odd, then, that an NT machine went from July 19 to Aug 1 without a reboot. So I may not be correct on this. If you install the patch and reboot the server, I think you've fixed the problem. -Brian