Not sure either, but it's happened ever since the http server has been in Hijack, and Nimda makes a return visit to the network here.