30th June 2004 - SYMANTEC.com

W32.Gaobot.AUS

W32.Gaobot.AUS is a repacked variant of W32.Gaobot.SN . The worm spreads through open network shares and through backdoors that the Mydoom family of worms open. It allows attackers to access an infected computer using a predetermined IRC channel.

22 April 2004- SYMANTEC.com

The W32.Netsky.Z@mm

The W32.Netsky.Z@mm worm is a Netsky variant that scans for the email addresses on all non-CD-ROM drives on an infected computer. Then, the worm uses its own SMTP engine to send itself to the email addresses that it finds.
The From line of the email is spoofed, and its Subject, Message, and Attachment vary. The attachment has a .zip extension.

08 March 2004 - SYMANTEC.com

W32.Netsky.K@mm

W32.Netsky.K@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.
The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has a .pif extension.

This threat is compressed with tElock.

Notes:

• Symantec Consumer products that support the Worm Blocking functionality automatically detect this threat as it attempts to spread.
• The worm has an MD5 hash value of 0xE26BC65552359A226CE6589E60C22151.
• Symantec Security Response has developed a removal tool to clean the infections of W32.Netsky.K@mm.

07 March 2004 - SYMANTEC.com

W32.Netsky.I@mm

W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.
The Subject, Body, and Attachment vary.

17 Febuary 2004 - SYMANTEC.com

W32.Beagle.B@mm

W32.Beagle.B@mm is a mass-mailing worm that opens a backdoor on TCP port 8866.

Note: Security Response is currently investigating this worm and will post more information as it becomes available.
The email has the following characteristics:

Subject: ID <6 random characters>... thanks
Attachment: <7 random characters>.exe

Notes:
• Beta definitions 27975, dated Feb 17 5:20AM PT, or later will detect this threat.
• Initial builds may detect this treat as W32.Alua@mm or W32.Aula@mm.

W32.HLLW.Deadhat - SYMANTEC.com

W32.HLLW.Deadhat is a worm with backdoor capabilities. It attempts to uninstall the W32.Mydoom.A@mm and W32.Mydoom.B@mm worms, then spreads to other systems that are infected with Mydoom. It also spreads through the Soulseek file-sharing program.
This worm may be found as a file named "sms.exe" in the %System% directory.
Note: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).