A team of researchesrs at UCSB hijacked Torpig (a botnet which comes as a payload of mebroot) for 10 days. They observed over 180,000 infected systems, and boatloads of stolen information.
The insights they gained are interesting and can be read here (pdf).
Alex Eckelberry