Remote Host Port Number 88.208.209.166 81 NICK n|USA|XP|COMPUTERNAME|fusjplw USER n “” “lol” :n JOIN #new# PONG 422 PONG :request.not.found Registry Modifications * The newly created Registry Value is: o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] + MSNUpdateServices = “%AppData%S-3685-5437-5687minsfot.exe” so that minsfot.exe runs every time Windows starts File System Modifications * The following files were created in the system: #Read more...

(IRC) [00|FRA|345724]: Bot sniff “124.40.3.92:8080” to “192.168.0.11:20782”: – “:hub.2217.net 221 fiqzkCnjy + :fiqzkCnjy!qospkdIFi@rue92-5-82-241-173-16.fbx.proxad.net JOIN :##+ :hub.2217.net 332 fiqzkCnjy ##+ :*sc ne 130 0 0 -e -b -r -s|*sc nb1 50 0 0 -e -b -r -s “

(IRC) [00|ESP|780449]: Bot sniff “192.168.1.101:1340” to “64.16.193.53:3921”: – “MODE ESP[XP|SP2]00[L]693632 -xt+iB JOIN #p4s r00t USERHOST ESP[XP|SP2]00[L]693632 MODE ESP[XP|SP2]00[L]693632 -xt+iB JOIN #p4s r00t USERHOST ESP[XP|SP2]00[L]693632 MODE ESP[XP|SP2]00[L]693632 -xt+iB JOIN #p4s r00t USERHOST ESP[XP|SP2]00[L]693632 MODE ESP[XP|SP2]00[L]693632 -xt+iB JOIN #p4s r00t

(IRC) [00|ESP|065790]: Bot sniff “203.190.166.115:7562” to “190.208.80.238:2071”: – “:b2js4nd5v3u!XPESP82221@190.208.80.238 JOIN :#100+ :ftpelite.mine.nu 332 b2js4nd5v3u #100+ : :ftpelite.mine.nu 333 b2js4nd5v3u #100+ Chakra 1287762402 “ “USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+ hzx USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+ hzx USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+Read more...

(IRC) [D00|ESP|77291]: Bot sniff “64.16.193.53:9595” to “88.31.150.71:1293”: – “:ESP|XP|SP0|00|1600|W|999986!jjhqift@71.Red-88-31-150.staticIP.rima-tde.net JOIN :#!sql# :HTTP1.4 302 ESP|XP|SP0|00|1600|W|999986 :ESP|XP|SP0|00|1600|W|999986=+jjhqift@71.Red-88-31-150.staticIP.rima-tde.net :HTTP1.4 302 ESP|XP|SP0|00|1600|W|999986 :ESP|XP|SP0|00|1600|W|999986=+jjhqift@71.Red-88-31-150.staticIP.rima-tde.net “

(IRC) [00|ESP|065790]: Bot sniff “204.45.85.210:47221” to “190.208.80.238:2765”: – “:hub.us.com 001 [N00_ESP_XP_2575850]___ :us, [N00_ESP_XP_2575850]___!SP2-383@190.208.80.238 : :hub.us.com 005 [N00_ESP_XP_2575850]___ :[N00_ESP_XP_2575850]___!SP2-383@190.208.80.238 JOIN :#dpi :hub.us.com 332 [N00_ESP_XP_2575850]___ #dpi :finito :hub.us.com 333 [N00_ESP_XP_2575850]___ #dpi str 1287854526 :hub.us.com 353 [N00_ESP_XP_2575850]___ @ #dpi :

(IRC) [00|ESP|065790]: Bot sniff “190.208.80.238:2071” to “203.190.166.115:7562”: – “USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+ hzx USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+ hzx USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts JOIN #100+ hzx USERHOST b2js4nd5v3u MODE b2js4nd5v3u +i MODE #100+ +nts “

(IRC) [00|FRA|720196]: Bot sniff “95.154.242.89:1122” to “78.235.246.30:3256”: – “:Cod!Coded@Coded.Cod PRIVMSG #!pert!# :.login kuzen “ (IRC) [00|FRA|720196]: Bot sniff “95.154.242.89:1122” to “78.235.246.30:3256”: – “:Cod!Coded@Coded.Cod PRIVMSG #!pert!# :.syn 72.20.58.220 6667 100 1000 “

(IRC) [00|FRA|309378]: Bot sniff “66.205.65.100:8080” to “192.168.0.11:3436”: – “:hub.56653.net 302 ezshChDky :ezshChDky=+lyCsdyhBa@rue92-5-82-241-173-16.fbx.proxad.net :hub.56653.net 221 ezshChDky + :ezshChDky!lyCsdyhBa@rue92-5-82-241-173-16.fbx.proxad.net JOIN :##+ :hub.56653.net 332 ezshChDky ##+ :*sc ne 130 0 0 -e -b -r -s|*sc nb1 50 0 0 -e -b -r -s :hub.56653.net 353 ezshChDky @ ##+ :ezshChDky :hub.56653.net 366 ezshChDky ##+ :

Remote Host Port Number 75.118.123.95 8080 PASS secretpass NICK gqlzHDrFG USER xykablogB * 0 :USA|XP|481 MODE gqlzHDrFG JOIN #i lol Other details * The following ports were open in the system: Port Protocol Process 1055 TCP wuaucpl.exe (%Windir%wuaucpl.exe) 17572 TCP wuaucpl.exe (%Windir%wuaucpl.exe) Registry Modifications * The following Registry Keys were created: o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsRead more...