This is the full time line of the salient events of both day 1 and 
day 3. There's plenty of chat activity that is excluded from this 
timeline.

Reconnaisance

  11/29/2002-09:36:25.3 - initial scan for dtspcd, 
  11/29/2002-09:36:25.5 - followed by an immediate connection attempt 
                          to ingreslock (1524) to see if the system had 
                          already been exploited.
  11/29/2002-09:36:25.7 - A quick check to see if dtspcd will respond

Exploit

  11/29/2002-09:36:26.2 - Launch the exploit
  11/29/2002-09:36:37.6 - Check ingreslock (1524) - BINGO!
                          Backdoor established; time to take over. 

Take ownership

  11/29/2002-09:42:42.1 - Grab tools from 62.211.66.16 via FTP 
  11/29/2002-09:45:29.0 - Grab rootkit from 62.211.66.53 via HTTP 
  11/29/2002-09:53:21.4 - Install rootkit

Start Operations

  11/29/2002-09:59:52.3 - Stacheldraht starts looking for handlers at
                          61.134.3.11, 217.116.38.10
  11/29/2002-09:59:52.3 - psyBNC starts up and we're chatting
  12/01/2002-13:41:44.9 - An apparent DoS attack on 195.130.233.20 begins
                          Duration: One hour
  12/01/2002-15:41:01.1 - Apparent port scan of 192.114.144.52
                                  Duration: 5 minutes 12 seconds
  12/01/2002-15:51:41.1 - Apparent port scan of 205.177.13.231
                          Duration: 19 minutes 33 seconds 
  12/01/2002-16:41:51.9 - SSH Connection from 62.101.108.86
                          Duration: 26 minutes, 53 seconds 
  12/01/2002-16:56:11.2 - HTTP connection to 62.211.66.55 to get psy.tar 
  12/01/2002-17:08:44.2 - Reboot: syslog packets logging shutdown (packet #117184)
  12/01/2002-17:10:39.5 - SSH Connection from 62.101.108.86 (17:11:29.2)
  12/01/2002-17:11:10.7 - First IPv6 activity - a multicast listener report
  12/01/2002-17:13:03.3 - First connection to IPv6 IRC channel 
                          (tunneled through IPv4 to 163.162.170.173)