www.melankolik.us

www.melankolik.us 174.120.135.28Download URLshttp://174.120.135.28/202/yenibot.php?hddseri=ACE1-A30C (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)http://174.120.135.28/202/kontrol.php (www.melankolik.us)Outgoing connection to remote server: www.melankolik.us TCP port 80Outgoing connection to remote server: www.melankolik.us TCP port 80Outgoing connection to remote server: www.melankolik.us TCP port 80Outgoing connection to remote server: www.melankolik.us TCP port 80Outgoing connection to remote server: www.melankolik.us TCP port 80Outgoing connection to remote server:

deli.byinter.net (turkish lamers)

deli.byinter.net 93.190.138.202 * C&C Server: 93.190.138.202:6667 * Server Password: * Username: ryatoaj * Nickname: [DEU|XP|516568] * Channel: #!x!# (Password: cih4n1313) * Channeltopic: : * C&C Server: 93.190.138.202:6667 * Server Password: * Username: XP-4392 * Nickname: [00|DEU|636610] * Channel: #x# (Password: hacimackackac) * Channeltopic: :.msn.stop|.msn.msg þu resme bi bakarmýsýn (yemekteyim) http://www.facebookbul.co.cc/images.php?=resim166-jpeg?= * C&C Server: 93.190.138.202:6667 *

bozoo.no-ip.biz

bozoo.no-ip.biz 94.120.148.91Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz TCP port 15963Outgoing connection to remote server: bozoo.no-ip.biz

67.43.226.2

ip : 67.43.226.2 port : 5540#tegane /NICK x|XP|132701#sutido /NICK ESP-NPUKP#final /NICK [JUM]-390187#surtido!login misamores lasamoo found by bi0

louisianadynamics.com

ip : 66.252.13.214h : louisianadynamics.comport : 9890 9890NICK F-olmgmodpUSER F-olmgmodp 0 0 :F-olmgmodpJOIN ##S## whith pass J

proxim.ircgalaxy.pl

Remote Host Port Numberproxim.ircgalaxy.pl 65520 NICK zttwuhgsUSER t020501 . . :-Service Pack 2JOIN &virtu * The following files were modified: o [pathname with a string SHARE]msinfo32.exe o [pathname with a string SHARE]sapisvr.exe o %ProgramFiles%Internet ExplorerConnection Wizardicwconn1.exe o %ProgramFiles%Internet ExplorerConnection Wizardicwconn2.exe o %ProgramFiles%Internet ExplorerConnection Wizardicwrmind.exe o %ProgramFiles%Internet ExplorerConnection Wizardicwtutor.exe o %ProgramFiles%Internet ExplorerConnection Wizardinetwiz.exe o %ProgramFiles%Internet ExplorerConnection

cx10man.weedns.com(Mouse’s 100k net)

Remote Host Port Numbercx10man.weedns.com 3305 PASS secretpassNICK b2s5zj80qUSER cb5tcxdf2 * 0 :USA|XP|373 Resolved : [cx10man.weedns.com] To [210.166.223.51]Resolved : [cx10man.weedns.com] To [209.235.252.106]Resolved : [cx10man.weedns.com] To [200.49.145.197]Resolved : [cx10man.weedns.com] To [92.240.234.164] * To mark the presence in the system, the following Mutex object was created: o gx000032 * The following port was open in the system: Port

cracker019.dyndns.tv

cracker019.dyndns.tv:6667 NICK {USA-XP-3917184}USER {USA-XP-3917184} * 0 :COMPUTERNAMEMODE {USA-XP-3917184} +iRJOIN #torrentPRIVMSG #torrent :.4.New Infection!MODE #torrent +iMmNICK {USA-XP-5140760}USER {USA-XP-5140760} * 0 :COMPUTERNAMEMODE {USA-XP-5140760} +iRNICK {USA-XP-4060724}USER {USA-XP-4060724} * 0 :COMPUTERNAMEMODE {USA-XP-4060724} +iR Registry Modifications * The newly created Registry Value is: o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] + MSN Messanger = “%Windir%System.exe” so that System.exe runs every time Windows starts Memory Modifications

dbsarticles.com

* Requested Host: dbsarticles.com* Resulting Address: 75.102.24.35 * IRC Data o User Name: XP-4072 o Host Name: * o Server Name: o Real Name: MICHAEL-F156CF7 o Password: xxx o Nick Name: [USA|00|P|55591] o Non RFC Conform: 1 + Channel # Name: #imb # Password: test # Topic Deleted: :.msn.stop|.msn.msg foto 😀 http://yorimage.yo.ohost.de/photo.php?= # Transport Protocol:

rohypnol.bounceme.net

rohypnol.bounceme.net:6667PASS pass8900NICK n-870346USER ecdsdhrp 0 0 :n-870346USERHOST n-870346MODE n-870346 -x+BJOIN #channel pass8900NOTICE n-870346 :.VERSION mIRC v6.14 Khaled Mardam-Bey.PRIVMSG #channel :[MAIN]: Status: Ready. Bot Uptime: 0d 0h 0m.PRIVMSG #channel :[MAIN]: Bot ID: Tr0gBot.PRIVMSG #channel :[Scn]: Exploit Statistics: NetBios: 0, NTPass: 0, Dcom135: 0, Dcom1025: 0, Dcom2: 0, MSSQL: 0, lsass: 0, Total: 0 in 0d 0h