>>Unless I just missed it, no one seems to have made mention of the fact that this virus is especially bothersome to Foxers. It deletes all files with the SCT extention. IOW, FORMS!
>
>That's just a unpleasant coincidence, I imagine. I'll bet the hacker was going after the other SCT file extension, which is some kind of script file, I think.

Bruce,

We just went in and fixed an NT machine that got infected. Essentially you have to go into the registry and delete out the files the virus creates. Get a hold of the code for the virus from any of the infected files and go through it to fix the machine. We had to delete at least 2 files. If you are lucky enough and the machine got infected after the websites the virus looks at were taken down, you will have less cleanup to do. Look for regcreate in the code, it will lead you in the right direction. HTH