are you auditing your network? if so, the vbs virus goes out and looks for every drive either local or mapped to rename the picture files and such, so setup auditing to track down when files are changed. to make this easier on your security log setup a dummy folder with a bunch of file types that the virus attacks and audit up the but. So the next time you get hit with the virus and gets to the folder in a network drive, you can see in the security log the username that did it, setup a dummy folder in each of your shares if need be. That should do it for you I would think.

------------------
we are number one, all others are number two......or lower