Quenching a QAZ quandary quickly...

[Robert Washam <rwasham () FNCI COM>]

Well, it was fortune that brought Josh Brandt's post of 9/8/00 to my door:
The very day before, QAZ visited me.  And keeps coming back.  You feed these
viruses and they just want more and more and... Okay, so here is the
question:  Since I am now the lucky owner of this wonderful virus, how is it
coming back all the time?

        1. I've replaced NOTEPAD.EXE with Norton's Quarantine/renaming note.com;
        2. I've done Reg Search & Replace and there is NO SIGN OF ANY BAD
notepad.exe OR QAZ in there;
        3. The same machine gets hit every five to seven days;
        4. It is on a private IP network (10.0.0.0) behind a Cisco setup for NAT
and with my SPECIAL access list to block most things/ports;
        5. The only other machine running Windows XX is an NT Server that APPEARS
to be fine.

I suspect Outlook.  But then again, I always suspect Outlook.  Anyone know
how it might live in Outlook?  I'm checking DOT files for template
infections, I've searched the infected system for note*.* and even *qaz*.*
but no luck.

Any help, as always, is appreciated.

Thanks,
Robert