Raaf has a good point.

Since you mentioned you thought it might be a worm also. This link has some good worm detection programs you can d/l and run. http://securityresponse.symantec.com/

You may need to look around for the one you need.

Best of luck.