Looks like there is a new virus out called Nimda. It attacks web servers much like the old CodeRed did. It leaves a very obvious footprint which makes it easy to track. I wrote a quick PHP script to check for it, so far today one of our servers has been hit 1272 in less that 8 hours.