Interesting Variants

Dual faced worm
Attacks clients and servers
Saw some of this in Nimda
Evades role based anomaly detection

Jumping executable
Small, finite number of copies in existence
Random walk of the Internet
Requires patience
Difficult to track, doesn't fit growth model