> Do we know if anyone has looked at the code for variants of the worn > in detail recently? I've seen announcements about new versions with > better random IP address generation. Does anyone know if other > aspects of the worm are the same? Is it still set to spread itself www.incidents.org and www.dshield.org are reporting on them in some detail.