Conclusions

The Good News
CodeRedII (and its variants) are dead
The Bad News
CodeRed and Nimda are here to stay
Widespread scanning for open servers
11 Israeli hosts scanning 200-1000 hosts daily in December
Using Active-X-based scanner, based on CSHttpClient User-Agent
New worms will be even better
Expect major DDoS attacks in the near future