Apparently discovered yesterday. It tunes some parameters to spread faster and puts hooks into network-accessible drives to load from there in the future. http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-123015-3826-99&tabid=2 -Nate