Final Score: MS–1, “Rustock” Botnet - 0

Microsoft has brought down Rustock, a notorious botnet responsible for sending billions of spam emails, the company said in a blog post.

Microsoft said the botnet had infected millions of computers and was sending out fake Microsoft lottery scams, and offers to sell fake prescription drugs.

Here is some detail from Microsoft’s blog:
“Today, I’m happy to announce that based on the knowledge gained in that effort, we have successfully taken down a larger, more notorious and complex botnet known as Rustock. This botnet is estimated to have approximately a million infected computers operating under its control and has been known to be capable of sending billions of spam mails every day, including fake Microsoft lottery scams and offers for fake – and potentially dangerous – prescription drugs.”

After receiving permission from the US District Court for the Western District of Washington, Microsoft has mounted a coordinated action with the US Marshals Service and executed a number of online and offline actions that resulted in Rustock's takedown.

"Specifically, servers were seized from five hosting providers operating in seven cities in the U.S., including Kansas City, Scranton, Denver, Dallas, Chicago, Seattle, Columbus and, with help from the upstream providers, we successfully severed the IP addresses that controlled the botnet, cutting off communication and disabling it."

"Microsoft also worked with the Dutch High Tech Crime Unit within the Netherlands Police Agency to help dismantle part of the command structure for the botnet operating outside of the United States. Additionally, Microsoft worked with CN-CERT in blocking the registration of domains in China that Rustock could have used for future command and control servers."

Now is the time to work on cleaning up the huge number of infected computers. Maybe putting the fix in an MS Tuesday update might help? Not really. It’s going to take a lot of work to do that.

Oddly enough, what led to Rustock’s downfall was the use of MS’s logo which is tm’d. That abuse gave the Court the ability to OK the takedown.

I.P. really does count for something!