I remember encountering this same issue back during the Code Red/nimda worm days. When my webserver would get hit with the query string that demonstrated an in

I remember encountering this same issue back during the Code Red/nimda worm days. When my webserver would get hit with the query string that demonstrated an infected machine trying to find another victim, I would fire off a callback to that machine exploiting the same vector that would reboot it in the hopes that someone would notice their machine was infected. I knew I was technically in violation of the law (contra certain amusing "self-defense" rationalizations) however.