The spambot trojan Srizbi accounts for 39 percent of global spam, followed by Rustock at 20 percent, Mega-D at 11 percent, Hacktool.Spammer at 7 percent, Pushdo at 6 percent and Storm at 2 percent.
The numbers track the quantity of spam produced by each botnet, not the total number of systems infected.
The profile of Mega-D, which ARS Technica said in early February was swiftly rising through attack methods based on social engineering, is dropping because of a 10-day control server malfunction. Mega-D's attack uses mirrors of social website emails and actual Flash animations, which are offered after users install a "Flash update."
Ozok recently was identified as the malware behind Mega-D.
Srizbi has become the top spam generator with an assault using celebrity porn spam that says, "The Pornos is New!"
The Storm network once accounted for 21 percent of all spam in its heyday, containing an estimated 85,000 "zombies." Mega-D rose to account for 32 percent of the spam network in early February but only used an estimated 35,000 bots.
Several botnets recently have been employed to advertise individual products or collections of products. Over several weeks, Marshal picked up ads for the "Express Herbals" website from sources contaminated by Srizbi, Rustock, Hacktool.Spammer and Pushdo.
Clicking on the links enables the download of several trojans, including Srizbi, Marshal said.