Perhaps to deal with this in the future, you can go down this dark and shady road...
Put a notice on the site that only miners pulling in at least 10MH/sec are welcome.
This will not keep out the cpumining botnet, but it will establish the terms of your pool and the botnet would be violating those terms. Then, once you identify a future botnet, invalidate 2/3 of all shares submitted by miners running less than 10MH/sec and just pretend like they didn't happen. Net result, the rest of us benefit from the work of the botnet and the impact to the botnet's profitability might be low enough that they don't even notice.
and what about the Legit users under 10 mh a sec? oh right 'they are not important'. how could i forget..
They are not worth... probably they cause more problems (bandwidth/resources consumption) than their benefits (Mhash/sec).
So I think it's a good idea that larger pools allow only "gpu" users meanwhile "cpu" users must be confined to smaller polls where they are welcome.
My 2 cents