Yah, but i took the lame way out. Since i know that that is the file that causing problem. I summited the file to Symantec and Trendmicro for anlysis. But what jtheriot suggested is good especially when the virus is not known to any antivirus yet. It get more difficult to pin point as now it no longer goes to file.

Machine infected: win2k server, Machine that were infected in memory but no windows24.exe created in WinXP