Microsoft didn't crush the Storm botnet as it has claimed, rival security researchers argued today. Instead, the criminals responsible for the army of compromised computers diversified last year to avoid attention and expand their business.

Paul Ferguson, a network architect with antivirus vendor Trend Micro , and a colleague, Jamz Yaneza, a Trend Micro research project manager, disputed Microsoft's contention that the Malicious Software Removal Tool (MSRT) had beat Storm into submission .

The MSRT is a program that Microsoft updates and automatically redistributes to Windows users each month on Patch Tuesday. It includes definitions for the most popular malware, sniffs systems for malicious code and then deletes it. Microsoft first added detection for the Storm Trojan in September 2007.

By Microsoft's count, the MSRT cleaned more than 526,000 Storm-infected PCs in the final four months of last year. After some back-and-forth between the Storm bot herders and Microsoft, the former gave up, said Jimmy Kuo, a senior security architect with the Redmond, Wash. developer.

"Even though they were able to maintain parts of their botnet, they knew they were in our gun sights," Kuo said in an interview earlier this week. "And ultimately they gave up."

Not so fast, said Trend Micro.

"The MSRT had an impact on Storm," Ferguson acknowledged, citing Trend Micro statistics that showed a 20% to 25% reduction in the number of bots within the Storm botnet late last year. "But there are some key gaps in the reality on the ground.

"Storm is still out there," he said. And active. "We've seen campaigns to renew their [botnet] body count within the last 48 hours."

More important, though, is the big picture, said Ferguson and Yaneza. Storm is certainly diminished, they agreed, but not simply because of Microsoft and its MSRT.

"Storm's operators have been diversifying," said Yaneza, who has followed Storm since it first appeared in early 2007. In fact, the Storm botnet's current size -- considerably smaller than during 2007 -- was a matter of choice, not something forced on the hackers, Yaneza argued.

"They've changed business tactics, and diversified into other botnets, just like the Russian Business Network diversified by getting out of St. Petersburg [Russia] and is now working out of many facilities worldwide," he said.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports