Self-advertising vulnerable machines, passive scanning

When a machine has a vulnerable service exposed to the Net, it can be (and usually is) scanned for that and then infected. The worm then usually uses the machine as an attack base for scanning more machines and spreading itself exponentially.

By doing the probes, it advertises its presence - and also its vulnerability. Merely by listening to the probes on my firewall, I can make myself an up to date database of easy-to-compromise hosts for case of need. Then, when a proxy or other service needs to be used, look up the logs and pick a suitable victim for a temporary hijack. Passive way, minimizing chance of being detected.

Passive methods are the best for routine use. No broadcasting what you're doing, just listening. And knowing.