ahhh botnets, they are actually quite hard to manage unless you know how to fight av's. The storm bot is so effective because the owners of it constantly updated it and kept it undetected by anti virus software. Last i heard was that the storm bot was up to around 1 million bots or so and thats enough to take small countries offline, although it would be hard to do that unless you hit the isp's individually. But there are many types of botnets, win32, *nix, rfi nets, etc. You could in theory create a good bot that will remove the storm or other but you have to know how it starts, if they have a backup file on your system to re-download it if deleted, where it is in the registry etc. For win32 and *nix bots you can remove them with a "good" bot, but for rfi nets those run in php so you will have to first close the rfi vuln, then restart your php service, which can be a hastle because finding the rfi vuln in big sites takes time, and you first have to know that there is malicious code running which can be even harder to detect.
