Latest Storm Worm - Is it a VMware or Virtual PC hopper?
The Storm worm (aka Nuwar) is one of the worst threats out there as it contains some of the latest advancements in malware techniques (including very realistic social engineering on it's latest e-card versions). While most users don't run Virtual Machine environments, one variant seems to be searching for it to possibly hide better or even damage other logical partitions 

Latest Storm Worm - Is it a VMware or Virtual PC hopper?
http://isc.sans.org/diary.html?storyid=3190
QUOTE: While the Storm worm hasn’t brought anything really new, the authors definitely went a step further – the Storm worm’s code looks much better than a lot of malware we’ve seen. And besides that, you have a custom packer that makes analysis and detection more difficult, rootkit capabilities so it’s completely hidden, P2P botnet control and so on.
While analyzing one sample I noticed that the Storm worm tries to detect if it’s running in a virtual environment. This became pretty popular with malware writers lately. The main reason their doing this is (presumably) to make analysis more difficult. The first step in malware analysis today is typically to run it in an isolated environment and to monitor its behavior.