As many as 5% of PCs are infected with malware - short for malicious software - Prof Anderson said, and there was a one in 20 risk that any given computer was sending spam without the owner's knowledge.
"If you want to defend against this kind of threat it's not enough to just shoot a few crocodiles, you have to drain the swamp," Prof Anderson told BBC Radio 4's Today programme.
BBC News - London hosts cyberspace security conference