Your analogies aren't valid, because you're talking about cases where there is the threat of physical harm to an actual person. The Code Red virus is annoying, and it's causing major problems, but it's not going to kill anyone, and it's not going to permanently damage your system.

The only thing that you have the right to do it to tell the admin of the infected server via email. If they ignore you, run a traceroute and ask their service provider to firewall them for port 80. Then they'll have a real incentive to fix the problem.

If you attack someone else's machine, then you're on exactly the same ethical level as the person who wrote the original virus.

SPQA