Re: Can Somone Tell Me If We Have a Hacker?
- From: jeff.nospam@xxxxxxxx (Jeff Cochran)
- Date: Tue, 27 Jun 2006 20:34:04 GMT
On Tue, 27 Jun 2006 09:26:02 -0700, razor
<razor@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Hello--
I am pasting an event log from our IIS/web server that repeats about 50
times every day during non-business hours. Our SQL administrator seems to
believe that somone is trying to hack into our system via FTP.
Can somone tell me if the below is a hacker, and what we can do about it?
Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 6/25/2006
Time: 12:45:25 PM
User: N/A
Computer: PWARDELLIIS
Description:
The server was unable to logon the Windows NT account 'Administrator' due to
the following error: Logon failure: unknown user name or bad password. The
data is the error code.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2e 05 00 00
It's likely a script. You can block it through proper firewall rules,
or if you don't use FTP disable it.
Jeff
.
- Prev by Date: Re: The IIS service does not seem to be serving up .asmx or .asp p
- Next by Date: Re: SSL issue OWA 2003
- Previous by thread: Re: Can Somone Tell Me If We Have a Hacker?
- Index(es):
