I’ve decided to start using Windows 2000 AD Group Policy to help control virus outbreaks and infection on computers connected to our network by using Software restriction policies. This was quite useful when Sober hit us. When it hit us, Symantec did not have virus definitions out yet. But I was able to figure out which .exe are created and their paths.
In the case of Korgo I used a Hash rule since the .exe generated was of a random name.
This method seems useful and thought I might share the info.
