Knocking McColo offline, on the other hand, -- "Rustock" and "Srizbi" -- said Stewart, and caused spam to plummet around the globe.

Stewart, a leading authority on botnets, last April. Srizbi, at 315,000 bots, was No. 1 in his census, while Rustock, at 150,000, was in the No. 3 spot.

Rustock's handlers, said Stewart, may never recover control of their bots. "It does look like they're lost to them," he said, noting that those bots lack a failsafe for reconnecting with a command-and-control server if it does dark, as happened when McColo's plug was pulled.

But while Rustock's bots may be orphaned, there's a chance the Srizbi's bots can be brought back under control. "When Srizbi bots can't connect, as a backup they're coded to try other domain names," to search for new command-and-control servers, said Stewart. Those domains, however, were recently registered, perhaps pre-emptively by a security researcher who had rooted through the Srizbi code.

"They're not receiving new instructions," Stewart said. That would indicate that a third-party -- someone who didn't have the Srizbi source code, and thus a way to figure out the protocols for sending new orders to the disconnected bots -- may have snatched up the domain names.