Guys from the SRI International were made really good analysis on the currently most active Virus/Worm, Conficker, also known as Downup, Downadup and Kido. Analysis can be found at http://mtc.sri.com/Conficker/.