We have now analysed the new worm (see below) further. It’s actually a new variant of Atak – Email-Worm.Win32.Atak.h. Some variants of this family are similar to some of the Mydoom worms.
Atak.h copies itself to the Windows system directory as dec25.exe
It writes itself to win.ini to ensure that a copy of the worm is launched each time the victim machine is started.[windows] run=file path dec25.exe
A full description will be available soon.