Network World has an article about Storm which they report is potentially the largest botnet in the world:
In another article they write:
The most important thing about Storm, and the point on which everyone seems to agree, is that it creates botnets. Once a PC visits an infected Web site and Storm is downloaded, the PC is considered compromised, which means it can be controlled by someone else without the user knowing it. Together these compromised PCs create botnets that can be used to covertly send spam, launch distributed denial-of-service attacks, or host Web sites that download more malware.
The thing I don't yet understand about Storm is exactly how to figure out your computer is affected with this malware since the file names change constantly and the hacker is constantly changing the way it works. Is there something in the way of network traffic that can pin down an affected machine? Is there some way to define this when someone clicks on a link and goes to your web site? Someone needs to look at it from this level to help nail this down. If someone could track when someone clicks on a web site that is infected and trace that back to the hosted web site and stop the problem there, that would help.