Leaving aside the issue of ethics... (Score 1)

Even if one were to send out an anti-virus to "fix" Code Red II, there's no guarantee that the backdoor hasn't already been used to insert far more dangerous code. Now the user may check for root.exe or the registry settings, decide he or she wasn't infected, and merrily go about their business. Meanwhile their machine is patiently waiting for the next DDoS command.

Better the user nuke and pave an infected machine and learn that painful lesson.