I too find the "wintask" packets interesting. Notice that both syn packets contain an ack which means this is a responce to something.


It looks like the attacker is testing the FTP server abilities by uploading and downloading the same file, which points to a pub scanning tool. ( it's a one kilo byte test file ...1KBTEST".. also note the "wintask" packet that contains the string "testtesttesttest" and 1KB of data)


The deleting of the space.asp file also matches the sig of a pub scanner. (Grim??)


Thoughts ??