Found an interesting article posted by Trend Micro which talks about some research they have done on infected machines. A sample of 100 million compromised IP addresses was used in this study which showed 1/2 being infected for an average of 300 days. If the length of time is decreased to 30 days then the number changes to 80%.

Infection data by country

Out of the 1 million IP addresses 3/4 were identified as consumer users and the remain 1/4 were related to enterprise level networks. Because enterprise level networks typically have a handful of gateway IP addresses that could potentially represent thousands of hosts.  The number of infected hosts on these networks may be more.

The conclusion of the study comes to no surprise to anyone who is currently in the trenches in the security industry. The AV vendors constantly struggle to keep up with the ridiculous amount of samples being thrown at them every day. There are also many examples of malware disabling AV, windows firewall and modifying the hosts files to prevent updates. Its only going to get worse and its unfortunate that a majority of the public has no idea what threats are lurking online.

Read More