I'm really concerned about the half-million Win2k hosts out there with compromised root access. My ISP obviously isn't, but they should be. What to do? Microsoft currently recommends these machines be rebuilt. Whilst the scanning is slowing down, someone else (or maybe the original author) is preparing a massive distributed-denial-of-service infrastructure.