It may be the case, though, that Srizbi's creators thought of that, and that any fall-back domain names are not hard-coded into the bot but are generated using an algorithm of some sort. "If Srizbi is programming intelligently enough so it not only says, 'I'm going to try some new domain names,' but also 'if that new server is not sending valid data, then generate another domain name,' maybe they can be recovered," Stewart speculated.

Also helping Srizbi in the wake of the takedown, Stewart added, is that it used a more compartmentalized structure -- it's essentially a collection of smaller botnets that at some levels are shared -- which in turn meant that not all its command-and-control servers were hosted by McColo.

And not all botnets have been affected equally, Stewart said. "Bobax and Cutwail, they're still spamming," he said. In his April estimate, Bobax was No. 2 out of the 11 botnets, accounting for approximately 185,000 PCs, while Cutwail was No. 4, with 125,000 bots.

Worse, even if the Rustock and Srizbi bots have been permanently cut off from their criminal overlords, it doesn't mean the end of those botnets. It's all too easy for criminals to buy compromised computers from others, or simply seed their malware in a major campaign to infect new systems.

"I'm sure they'll be back," said Stewart.