If I remember correctly from before, there was some kind of connection scanner (like ping plotter) that use to check your connection to a few different places to track downtime. This program had a few connections (might have been only one) that were later flagged as part of the botnet network. Not sure if this relates, just pointing out in case you have something like this running.
·