For now, I turned OFF 'registering as a new user'. so no new bot accounts. I'll add some scripting to try to stop the bots again.. new questions to answer ect...
Those accounts were in a holding pattern anyway. no posts were made by them.
But anytime you see an attached file that is not an image, ALWAYS take care to scan it with many virus scanners and stuff.. (zip or rar files.. I don't allowe exe or com or scr files).
All is safe now. all those accounts are history!
Thanks for the heads up guys!!!!!