i found some more ips
2014-09-28 05:48 - [242.95.163.63] installed virus Generic Miner.vminer (1.5) at localhost
2014-09-28 05:48 - [87.52.216.126] downloaded file Basic Cracker.crc (1.4) at localhost
2014-09-28 05:47 - [242.95.163.63] uploaded file Generic Miner.vminer (1.5) at localhost
1.240.85.107
179.71.194.95
idk who they are really
go nuts