Hi Polonus,
Thanks for your kindly advice,
Yes, they are taking to turn off their worm server.
But this case happened few days ago, and infected quite a lot of user in Indonesia. But we had tried at office, and apparently avast! able to blocked this worm and identify as favicon.ico malware.
cheers,