I have since learned the bots i decribed are coded by a group of UK internet terrorists. They call the bot HaCore another is called GT and yes its main goal is for DDoS attacks, these bots sit on our network using a myriad of hosts, over 150 diff isp's and over 2000 individual subnets. I fear when i ask my isp to filter 150 isp's and over 2000 subnets, the answer will be WHAT @@!#@!#?

ill let you know how i go, have been a little busy recently, but plan to sort this out asap.