Scan or just silly behavior?

[John Quirk]

I don't know if this relevant to this but there is a worm that looks for
open netbios shares over TCP/IP and if finds one copies itself onto the
computer it finds replacing the windows notepad.exe file. It looks for a
windows or windows NT machine. I know though personal experience that
this happens. My virus scanner caught it before got to the next stage.
Which is to then organize things on the windows machine so that it
executes every time the machine is started once this is done it then
goes out and searches for more victims.

A better description can be found on most of the anti virus web sites
under worm.QAZ or worm32.QAZ.

The thing is sneaky in that all it needs in one machine in a network to
be open for it to slide onto its drive. Of course these have to be
windows machines for to able to propagate itself.