Microsoft is taking a stand against what it says is one of the largest botnets currently active worldwide the spamming botnet Srizbi.
At its peak last year in May, security vendor Marshal claimed Srizbi was the world's largest spam botnet, responsible for half of all spam. At the time it was estimated to have compromised 300,000 computers, generating more than 60 billion spam messages.
Microsoft's Malicious Software Protection Tool (MSRT) will target Srizbi and hope to do as good a job as in 2007 when it targeted the Storm botnet. It was quoted as removing the bot from approximately 91,000 machines in one day, with the botnet shrinking until September 2008 when it stopped spamming.
The Srizbi malware family consists of trojan droppers (a standalone program that drops different types of malware) and rootkits (a program designed to hide the fact a system is compromised). These are spread though spam emails, containing download links to the malware.
Srizbi authors created the botnet as a way of sending spam emails for criminal's intent on flooding victim's inboxes. Upon activation of the rootkit, the infected computer effectively becomes part of the Srizbi botnet as one of its bots.
Gavin Neale, security researcher at Marshal, said on the company blog that they were encouraged to see Microsoft once again target a major botnet infection and that it was necessary to remove it from infected computers.
However, he said that it wouldn't have a noticeable impact on spam levels because the McColo incident had already cut Srizbi spam levels, as McColo hosted its control servers.
He said: "Srizbi's place has been taken over by other spam botnets such as Mega-D and Xarvester. Together these botnets are currently sending around 65 per cent of the spam we see.
"Xarvester appears to have a close resemblance to Srizbi and the former Srizbi controllers may have switched to the Xarvester botnet after the McColo shutdown. We believe targeting the Mega-D and Xarvester botnets would have a greater impact on reducing current levels of spam."
