i mentioned earlier the worm generated 250 domains every day randomly, and when rick weston got arms around corralling all 250, the c variant generated 50,000 domains every day. it's almost like, well, you know, you're willing to spend this amount of money, time, and effort to stop us, but are you willing to make an expo enissue leap? there's another step beyond that. >> that's right. >> in fact, you know, they actually managed to recruit the corroboration of every top level country domain in the world, all 110 of them, and got their arms around 50,000 a day, only to have the worm introduce peer-to-peer communication, so they didn't even nude #* need it. >> do you think they were doing it on the fly? seeing and responding? >> without a doubt. and they put little clues in that they were monitoring, you know, the traffic on the list serve that they maintained, and they were tapping into sris system just to check on, you know, how porous and what others -- >> without giving away identity? >> no, they didn't. one of the interesting things they did is the communication from the worm to th

that was one example of the cunning nature of the thing, and rick weston, who may be here tonight, t.j mentioned him, he bought the domains on his credit card, giving you a sense of how ad hoc the effort was to try to stop it. >> before we go further down the path of the worm's evolution, back to the question of, you know, what straights we're in, a question for t.j.. i have a very old e-mail address, and i have a filter in it -- >> what's that? >> that's true. [laughter] i think most of the people here know my e-mail. [laughter] since most malware, i take it is distributed by botnets, and the level of spam is some rough correlation of the level of malware infections. my -- so i remember about a year ago, a large botnets was taken down and for awhile, spam fell off, but i have to say if i look historically at the number of spam messages caught every day, it looks like it's probably 10%-20% worse than it was before that happened. am i a good indicator of the state of -- >> it's a perspective situation; right? the operation you refer to is the roost bot take down, and we laugh at the rep

and rick weston who i think may even be here, t.j. mentioned in that moment ago, but all the demands and put him on his credit card, which gives you an essence of how ad hoc process for ways to try stop it. >> before we go further down the path of the worm's evolution, i just wanted to get back to the question of what kind of streets wearing. a question for t.j. i have a very old e-mail address and ever posting a filter in front of it. the >> what's that? last night's >> since most now where i take it is distributed by botnet from the farm -- well, the level of spam is some rough correlation in the level of now where action. so i remember that a year ago a large botnet was taken down and spam fell off. i have to say is i say if i look historically at the numbers that spam messages by posting everyday, looks like it's 10% to 20% worse than it was before that happened. am i a good indicator of the state? >> it's a perspective situation. so the operation referred to as b. one of seven. so we kind of sat back and lots of some of the repor

and rick weston who i think may even be here, t.j. mentioned in that moment ago, but all the demands and put him on his credit card, which gives you an essence of how ad hoc process for ways to try stop it. >> before we go further down the path of the worm's evolution, i just wanted to get back to the question of what kind of streets wearing. a question for t.j. i have a very old e-mail address and ever posting a filter in front of it. the >> what's that? last night's >> since most now where i take it is distributed by botnet from the farm -- well, the level of spam is some rough correlation in the level of now where action. so i remember that a year ago a large botnet was taken down and spam fell off. i have to say is i say if i look historically at the numbers that spam messages by posting everyday, looks like it's 10% to 20% worse than it was before that happened. am i a good indicator of the state? >> it's a perspective situation. so the operation referred to as b. one of seven. so we kind of sat back and lots of some of the repor