"Either they don't care, or they don't have enough resources to patch every machine," Kandek speculated.

Because some machines are never patched, there is always a ready reserve of potential victims, even for aging malware, Kandek continued. "Even very old worms can be successful," he said.

The notorious Conficker worm is a case in point. Though it's not old by any definition -- it debuted in November 2008 and just came to prominence in January 2009 -- Conficker's makers prey on PCs that have not been patched with an emergency update Microsoft issued last October. Last week, even after a media blitz about the worm's , of the PCs Qualys scanned were without the MS08-067 update.

As if to flaunt that fact, the newest version of Conficker its ability to spread by exploiting the Windows bug.

Microsoft's products are not the only ones that never get completely patched, Kandek warned. Some of Adobe Systems Inc.'s applications are in the same boat. "There are always stragglers," Kandek said. "Microsoft Office is one of the biggest stragglers for patching, and Adobe Reader is another. They're just not on the map for many companies."