Cyber Attacks on Governments

See my earlier responses for some initial thoughts. Also note that most well-written zombie malware is stealth in nature. It hides below the "radar" of the average user and doesn't make itself known (in many cases even after it is activated). Further, malware writers change the malware on a frequent basis to evade the security software that users might have installed. So once planted, it can be very difficult to get rid of from your computer.

An infected computer would, in fact, have to be in an operational mode in order for it to participate in the DDOS attack. Note that I said "in an operation mode" though I didn't necessarily say turned on. For example, a computer could be in low-power or suspended mode and appear to be off but from which the malware could be activated.

There are many ways that malicious software can find its way on computers. The most common ways are through opening infected e-mail attachments and visiting Web sites that host malware. Another common method and the way this malicious code may have been placed on computers is by users simply visiting a trusted Web site with images, banner ads or embedded scripts that pointed users to other Web sites that placed malware to their computers.

For the infected computers to take part in the denial-of-service attack they would have to be powered on. It is generally best practice to power your machine off while not in use.