resetting the pwd will prevent future infection. Not sure about later, but it should. My guess is the worm keeps attaching via sa.

Your description of the web sites sounds fine.

Steve Jones

steve@dkranch.net