final analysis of worm

You might wish to read this.. It would seem to explain what we saw on various networks as well with some Cisco 7200 series routers. http://lists.netsys.com/pipermail/full-disclosure/2003-January/003729.html