if you grep your http access log for "default.ida" (good sign of a code red attempt on an apache box) you'll see that code red has infected as many new machines in the alst two days as it did on 20 July