Experts had pegged Conficker infections in the 2 million to 4 million range, but IBM's numbers suggest that they may be much higher than that, perhaps in the tens of millions.

Still, Stewart cautioned against concluding that 4 percent of Internet users had been infected. "It's not a perfect number, nothing is. But it's the best that we can give with the data we have right now."

It's possible that Conficker infections are approaching 4 percent, said Danny McPherson, chief security officer with Arbor Networks. Because Conficker is more likely to infect certain types of users -- broadband consumers are generally more vulnerable than enterprise or government users, for example -- estimates like ISS' could come from a sample that does not represent the Internet as a whole, he said.  

Still, by any measure, Conficker is a big problem. "Even if they're off by an order of magnitude -- which is possible --  the number of infected machines is immense."