They all have it as a low-incidence in the wild. What I don't understand is that if it hasn't spread, what caused the attack against Microsoft this morning?
A worm that spreads this way can't become huge for obvious reasons, but it still spreads, thus the DDoS against MS.
There is a some (naming) confusion in the different vendor web pages about this worm, but the interesting part is that Mydoom.A's source code is included.
Gadi
