>All the rest you say I'm sure is very true, and that's why it worked so effectively. I saw the .VBS Rename inside the code, too.
Except one detail, that is - it did not run WSH, unless it copied new versions of WSCRIPT and CSCRIPT, I guess. We had those two files removed on all machines, and still the virus ran fine.
The Anonymous Bureaucrat,
and frankly, quite content not to be
a member of either major US political party.
