If you can, save the worm-- as evidence and "revenge"... One time I saw someone *trying* to hack my system via an Apache log entry... so I downloaded the script, neutered it, and let it connect to its IRC bot network... just sat there and collected the IPs of systems running the bot and started firing off emails to their administrators alerting them ;)