Tom,
I can't answer your question, but I do want to thank you for the filter. It's completely compatible with an nsvhr master reverse proxy, and it appears to be helpful in keeping nimda in check.
There are some other nimda requests that I'm trapping /_*, /msadc/*, /MSADC/*, /c/* /d/*, and while I understand why you try to direct the attack back against the host, I think channeling it to http://www.microsoft.com is equally reasonable.
