Many PCs still infected after Rustock botnet shutdown

According to Microsoft's latest analysis, based on "sinkholes", only just over half of the 1.6 million PCs once infected with the Rustock bot are now clean.

In March, Microsoft's Digital Crimes Unit (DCU) used a legal trick to have the botnet's command & control infrastructure taken down. Hard drives were confiscated from providers and domains were shut down or ownership transferred. Symantec says that the volume of spam collapsed as a result because the botnet was the largest sender of spam at the time.

But according to statistics made public by Microsoft, when the botnet was taken down, the contaminant was left behind on nearly 1.6 million PCs. It simply cannot receive any commands, so it remains inactive. Nonetheless, the contaminants remain dangerous. If a bot herder manages to put up a new, compatible C&C infrastructure, the zombie network could be reactivated. At present, providers are redirecting communication with the bots to sinkhole domains so that the bots are only communicating with a harmless server. In this way, the bots are prevented from receiving new commands and delivering any data collected.