Here is the info from McAfee on you virus. By the looks of it you need to clean up the security on the network/machines. The easiest way to keep a worm from spreading is good security on ALL of your machines. I am going to guess there are some holes in your security measures and the worm is using those vuneralbilities to spread itself.
John
---------------------------------------
Network Propagation
The worm's file share propagation relies on target systems being accessible for one of two reasons:
Poor security on target systems
The credentials of the user logged on to an infected system are sufficient to access other systems on the network
The worm scans random IP subnets for machines present on the network. Once a system is found, the worm tries to connect to the 'C$' and/or 'C' shares on that machine. The following accounts are used for the connection (with no passwords):
Administrator
Owner
Guest
NOTE: The virus assumes the privileges of the currently authenticated user. If a blank password is insufficient on the target system, the current credentials could be sufficient to gain access on a remote system.
If successful, the worm will copy itself onto that share in one of the following locations (ie. Windows startup folder):
C:\WINNT\Profiles\All Users\Start Menu\Programs\Startup
C:\WINDOWS\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
\WINNT\Profiles\All Users\Start Menu\Programs\Startup
\WINDOWS\Start Menu\Programs\Startup
\Documents and Settings\All Users\Start Menu\Programs\Startup
Finally, the worm attempts to execute the copied file by calling the NetScheduleJobAdd function.
-----------------------------------------------------------------
Removal Instructions
All Users:
Use specified engine and DAT files for detection and removal of virus and trojan files related to this threat.
Many share jumping viruses rely on weak usernames/passwords. They attempt to gain administrative rights by using a dictionary-style attack, trying usernames like "admin" or "administrator" and passwords like "admin" or "123456". Beyond such weak usernames/passwords many can use the credentials of the local user. Meaning that if a super-administrator, or domain-admin logs on to an infected system or becomes infected, the virus will have access to all systems within its "reach". Such worms often rely on the presence of default, admin shares. It is a good idea to remove the administrative shares (C$, IPC$, ADMIN$) on all systems to prevent such spreading. A simple batch file containing the following commands may be of help, especially when run from a logon script, or placed in the startup folder.
net share c$ /delete
net share d$ /delete
net share e$ /delete
net share ipc$ /delete
net share admin$ /delete
