If the machine was found with IRC bot, how can I check the integrity of the machine to make sure that further compromised was not done? I have checked the logs and other events, but stuck now. Also besides DCC transfer, what are other ways that IRC bot can be dropped to the target?