Well I've just done an interesting test on a Win2000 system that came to me very cranky, with 100% CPU usage & several instances of SVCHOST.EXE, so of course you think Nachi.
System ran Vet, owner admitted probably not up-to-date. NTFS, so as my own system is 98/ME, commandeered another 2000 system in for attention, whacked the hard drive out of the other system in.
Ran AVG6 Free, fully updated.
Found eight Trojan infected files, with Downloader.Stubby.A , Secthought.B , BackDoor.Adbreak.B , Dropper.Swicer.A , all successfully cleaned.
Did Panda Online, found Downloader.L in one file, successfully repaired.
Did Trend Housecall, found 6 files with ADW_RULEDOR.C and TROJ_POPMON.A , uncleanable. Two deleted, four currently quarantined.
Ran Stinger, there was the W32/Nachi in SVCHOST.EXE, deleted.
Who can you believe? Is the system clear yet...? Sigh...
I was going to try the new a squared 2 on it ( see here: http://forums.windrivers.com/showthread.php?t=54767 ) but when I installed it on the system, requests for connection to megaprovider.nl started, so it's out for the moment.
Edit: more scans on the same system just for reference:
Sygate wouldn't download...
Trojanscan.com couldn't scan memory, system came up clear, database was late 2003.
Bit Defender found the Ruledor in the re-named files (Trend didn't once they were re-named) but didn't notice Popmon. Heuristics seem to be OK, it found a joke FakeFormat file not reported by anything else, and flagged it as not a virus. Others may have identified it too, but just not reported anything...
CWShredder found nothing.
I'll pass the system as cleared.