I don't think 1.5x indicates a botnet at all.

For one thing the Windows miner was optimized to be about twice as fast (which makes it slightly faster than Linux, but fairly close). Given that so many people use Windows a big jump is to be expected.

Second with the attention this coin is getting and the enormous price jump it is not surprising that many more people want to mine it.