yes ... those do look like warcraft3 warez files !!! if you want to block just his ip .. drop any incoming connections with the source ip of what you posted. keep checking your log files, might not tell you everything he did, but its a good indication. consider shutting off ftp .. and running sftp instead. or a better ftp package. HTH
