The irony of Conficker, which has infected an estimated 1 million to 10 million machines and has made attempts to sell fake antivirus to its victims, is that it remains so quiet.

"It's one of the largest botnets out there but currently it's doing nothing," says Nazario, who believes Conficker has infected about 5 million Windows-based computers.

The easiest type of botnet to count seems to be the spam botnets. According to Symantec's MessageLabs division, the top botnet in June was one called Cutwail, which generated more than 45% of all spam worldwide through a botnet controlling about 1.4 million to 2.1 million compromised computers at any time.

But the Federal Trade Commission's shutdown last month of Web hosting firm Pricewert, accused of illegal activities involving botnets and child porn (which Pricewert denies) has disrupted the Cutwail botnet, says Matt Sergeant, chief antispam technologist at MessageLabs.

Cutwail, which exists as two distinct malware versions "is not currently No. 1 anymore," Sergeant says. He predicts that by the end of July, it's likely the No. 2 botnet, Rustock, which had only controlled 4.5% of the world's spam, will jump to about 50% of spam, with Cutwail knocked down, though struggling for a comeback.

The buyers of spam services in the underground economy appear to be switching from Cutwail to Rustock, Sergeant suspects. Both botnets have existed for several years, with their master controllers suspected to be in Ukraine or Russian-speaking countries. Several other researchers see strong ties to Ukraine and Russia in general for all manner of botnets..

Nazario and Sergeant both say prosecuting illegal botnet activity is very difficult across the jurisdictional boundaries of different countries, though they credit the Federal Bureau of Investigation with determined law-enforcement efforts on this front today.

One of the most dangerous botnets out there, by many accounts, is Torpig, which is designed to steal identity credentials, credit cards, bank account and PayPal information, and more.

"It's very sophisticated, hiding on your machine with a rootkit to survive," says Joe Stewart, director of malware research at SecureWorks. "It will silently sit there in the system and grab bank account log-in and silently send them out of your machine."Infiltrating the Torpig botnet to find out exactly what it was doing was the mission undertaken earlier this year by eight researchers at the University of California, Santa Barbara, in the Department of Computer Science's security group. They set up a server in an undisclosed location and simply waited for Torpig to find it, based on an analysis of Torpig malware.