W32/Nachi.worm

[jmcavoy]

http://vil.nai.com/vil/content/v_100559.htm


This detection is for another virus that exploits the MS03-026 vulnerability.

It is not related to the W32/Lovsan.worm.d variant described here.

Intentions of the worm:
This worm tries spreads by exploiting a hole in Microsoft Windows. It instructs a remote target system to download and execute the worm from the infected host. Once running, the worm terminates and deletes the W32/Lovsan.worm.a process and applies the Microsoft patch to prevent other threats from infecting the system through the same hole. When the system clock reaches Jan 1, 2004, the worm will delete itself upon execution.

[Archer]

There's no such thing as good malware. It still does this without the user's permission," said Ian Hameroff, eTrust security strategist at Computer Associates International Inc., in Islandia, N.Y. "This is the Internet equivalent of a doctor who makes house calls, but it's a doctor you didn't invite over and you aren't real sure about his qualifications."

http://www.eweek.com/article2/0,3959,1224467,00.asp

Just about says it all