Nimda worm (SANS.org) - external
Symantec - W32.Nimda.A@mm
Current worm activity (CERT.org)
Nimda worm
Current Wave of IIS Attacks