The Witty worm first hit computers known to be vulnerable and emerged so quickly that most companies had no time to apply a patch, according to an analysis of the program.

[...]

[T]he worm was released in a way that would it allow it to speed its attack on vulnerable servers.

The Witty worm started spreading early Saturday morning. In about 45 minutes, the worm had infected the majority of vulnerable servers--about 12,000--on the Internet, according to the report. Within 10 seconds, 110 compromised hosts appeared, which led CAIDA to believe that those servers were used to actively spread the worm, a tactic known as 'preseeding.'

The Witty worm burned out quickly, due to its malicious nature. The worm slowly corrupted the information on a system's hard drive by writing 65 kilobytes of data to a random place on the drive. As a result, nearly half the systems infected by the worm crashed within 12 hours.

Compared with the Microsoft SQL Slammer worm, which infected 70,000 to 100,000 computers, the Witty worm attacked a smaller population, according to CAIDA. The worm also attacked computers that were specifically in place to protect against such threats.

The implications of this evolution should not be ignored, the report said.

'With minimal skill, a malevolent individual could break into thousands of machines and use them for almost any purpose with little evidence of the perpetrator left on most of the compromised hosts,' it stated.