To complicate matters further, a new variant of Conficker was spotted last week, and this one communicates primarily using peer-to-peer techniques, which are not easily measured by the Working Group's sinkhole servers. This means the group will probably need to develop a new way of counting infections as the peer-to-peer variant spreads, DiMino said.

Even though the Working Group's data is, at first glance, quite different from IBM's, its results are not a surprise, according to Holly Stewart, a threat response manager with IBM's Internet Security Systems (ISS). It's "really hard" to get a fix on the size of the botnet, she said. "I don't think anyone has a perfect answer," she said. "They have one data point and we have another data point."