ps my C&C info came from shadowserver's ddos reports. many thanks to them. -- ------------------------------------------------------------- jose nazario, ph.d. <jose at arbor.net> manager of security research arbor networks v: (734) 821 1427 http://asert.arbor.net/