Symantec says a new worm called W32.Spybot.ACYR spreads by taking advantage of a number of patched Microsoft vulnerabilities and a previously disclosed hole in Symantec's Client Security and Antivirus software. Symantec patched that hole back in May, but apparently some of its customers haven't applied that patch yet.
The botnet is hitting college and university networks primarily, with published reports citing infections as far away as Australia, and reports of infections at major universities in Arkansas, Texas, California and Minnesota in the U.S.