Another unidentified virus! Here we go again.
ciscv.exe is located in the system32 directory, and loaded by the registry Run and RunServices keys, labeled as "AutoVirusProtection". Ciscv is actually the name of a valid windows file. But don't be tricked - the infector exe is 157KB in size.
It then drops the file ICP.exe, which runs a cmd prompt - and amusingly displays a dancing cursor.
The ciscv.exe frantically scans the subnet looking for other machines to infect, and seems to disable (or change permissions to) the $admin share. It also tries to communicate back to the dns name http.pr3d.us over port 5001, using multiple IPs - so far I have seen 220.134.252.176, 221.87.136.42, 219.121.46.42, and 211.143.10.84.
Both these files have been submitted to Symantec for analysis, so hopefully tomorrow's signatures will detect them.