We appear to have been infected on a network that is very heavily firewalled from the outside, and are trying to track down possibly entry methods the worm might have had...

VPN or dialup? Laptop user that got infected at home and brought his machine into the office? -jay