SANS Internet Storm Center says that the average time for an "out of the box" Windows XP installation to be infected once connected to the internet is... 20 minutes. Here is their useful paper: Windows XP: Surviving the First Day