Re: Hacked or.....Would appreciate expert help



"Steven L Umbach" wrote:

> I doubt it is anything to worry about as it is a logon failure for username
> colony particularly for a single event and does not show subsequent
> successful logon for that user. It is normal to see logon success for local
> service. Chap can be used for logon via web server/IIS and remote access
> though chap requires that the user password be stored using reversible
> encryption which would be pretty unusual these days and require action by an
> administrator to configure as by default it is not done. --- Steve
>
>
> "plord" <plord@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:E7E593FD-A756-4B6D-9BB4-13B5F5991FFF@xxxxxxxxxxxxxxxx
> > This is a repost of question. I would sincerely appreciate someone
> > reviewing
> > the event log below, and confirming if it is the result of a hacker. It
> > occurred during non-business hours, and I am reasonably certain no one was
> > in
> > the office. All computers are password protected. Could a power outage
> > have
> > caused this?
> > Thank you for any help you can offer.
> >
> > Logon Process Name: CHAP"
> > 1/14/06 4:13:12 PM Security Failure Audit Logon/Logoff 529 NT
> > AUTHORITY\SYSTEM COLONY1 "Logon Failure:
> > Reason: Unknown user name or bad password
> > User Name: Colony
> > Domain: COLONY1
> > Logon Type: 2
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: COLONY1"
> >
> > 1/14/06 4:13:13 PM Security Success Audit System Event 515 NT
> > AUTHORITY\SYSTEM COLONY1 "A trusted logon process has registered with the
> > Local Security Authority. This logon process will be trusted to submit
> > logon
> > requests.
> >
> > Logon Process Name: LAN Manager Workstation Service"
> > 1/14/06 4:13:14 PM Security Success Audit Policy Change 806 NT
> > AUTHORITY\SYSTEM COLONY1 "Per User Audit Policy was refreshed.
> > Number of elements: 0
> > Policy ID: (0x0,0xCBB9)
> > "
> > Logon Process Name: KSecDD"
> > 1/14/06 4:13:16 PM Security Success Audit System Event 515 NT
> > AUTHORITY\SYSTEM COLONY1 "A trusted logon process has registered with the
> > Local Security Authority. This logon process will be trusted to submit
> > logon
> > requests.
> >
> > 1/14/06 4:13:16 PM Security Success Audit System Event 515 NT
> > AUTHORITY\SYSTEM COLONY1 "A trusted logon process has registered with the
> > Local Security Authority. This logon process will be trusted to submit
> > logon
> > requests.
> >
> > 1/14/06 4:13:22 PM Security Success Audit Logon/Logoff 528 NT
> > AUTHORITY\LOCAL SERVICE COLONY1 "Successful Logon:
> > User Name: LOCAL SERVICE
> > Domain: NT AUTHORITY
> > Logon ID: (0x0,0x3E5)
> > Logon Type: 5
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name:
> > Logon GUID: {00000000-0000-0000-0000-000000000000}"
> >
> > 1/14/06 4:13:22 PM Security Success Audit Privilege Use 576 NT
> > AUTHORITY\LOCAL SERVICE COLONY1 "Special privileges assigned to new logon:
> > User Name: LOCAL SERVICE
> > Domain: NT AUTHORITY
> > Logon ID: (0x0,0x3E5)
> > Privileges: SeAuditPrivilege
> > SeAssignPrimaryTokenPrivilege
> > SeChangeNotifyPrivilege"
> >
>
>
> I wish I knew how to reply on this site. Sure, I am not a computer geek, but I have had to go from knowing little or nothing to learning more than I ever wanted to know. I read all the good Windows XP books, like Bott's: Inside xp and Power, Security. I have tried to find anything at all that might help me. I spent weeks gathering evidence of hacking to send to the State's Attorney's office. He implied this wasn't important enough to give me an apppt., but he would look at my box of evidence. I sent the European and candid photos of people I never saw before, and these were NOT stock photos. I sent results of all the different scans I have done, such as . I sent floppies of incredibly suspicious files such as a couple of the ones I found that give a minute to minute report on what web sites so and so was going to next. Other hackees apparently watch a lot of porn, while I have never visited a porn site. I have a couple boxes of incriminating floppies, reports, and
IP addresses that are persistent. I have notified the internet providers of these customers, but they refer me to "computer fraud," meaning that I bought something online that wasn't what I thought it was. I have around 35-40 filled notebooks of all the strangeness that has gone on since I got my first Dell with XP. About two weeks later a drawing I never saw before came out of my printer from God knows where. It was a picture of a pine tree. Below the tree it said, "I am subtle like the taste of pine." Thus began our long relationship. I have used lots of tools trying to catch these guys myself, since no one would help me. (BTW, when I did call pollice, the cop came over and gave me the paranoid, brainless woman attitude. He insisted on formating and reinstalling XP himself. I tried to tell him that route had already been tried by myself and the so-called experts I paid for help. He could not hear me. He just kept saying that this would be the end of all my problems.
What a jerk. When he was done, the screen had that innocent look again and I could set things the way I wanted for a day or two, sometimes not even that.) Of course Dell and MS told me the same thing. I think the only two things the phone techs at Dell know, are system restore for everything; and if that doesn't solve the problem format and reinstall. You cannot imagine the frustration I have suffered with their simple suggestions, because they know nothing about advanced computing and my hackers know a very, very lot. I can't help but think they were MS techs gone wrong or something. MS does have some good tools such as MSBA and KB's I've used which include intruder detection. I have spent hours and hours, and days and days talking to sources I thought might help me; e.g. MS's new virus recovery hotline. This was finally set up, I believe, because after their big SP2 didn't work, they didn't know what to do to keep their goal of being trustworthy. I have also written Bill
Gates a few letters about what I think of XP. I am so, so sick of being treated like a dumb broad who doesn't know a genuine process from one that was added, but not by me; e.g. when I found the Active Network Monitor's report. I sure didn't put it there. I am coming to accept that I will never find a believer who knows enough about computers to fight fire with fire. Two days ago one more firewall that I spent 2-3 hours downloading, has vanished. I shouldn't even be online, but since I'm already hacked... Sorry this is long. Getting hacker help was an obession for a few years. Now I just try to get enough money togeher to buy a Mac. Hey want to see some evidence now? I have been the only user with access to my computer. And yet, here's some of my recemt failed logons. (It's always like this.): Type Date Time Source Category Event User Computer
Failure Audit 1/26/2006 8:39:56 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/26/2006 8:39:56 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/26/2006 12:32:40 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/26/2006 12:32:40 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/26/2006 12:32:33 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/26/2006 12:32:33 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 10:12:15 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 10:12:15 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 9:01:25 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 9:01:25 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 7:35:51 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/25/2006 6:41:10 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 6:41:10 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 6:36:54 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/25/2006 1:44:17 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 1:44:17 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/25/2006 12:00:39 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/24/2006 8:17:27 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/24/2006 7:29:00 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 7:29:00 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 7:28:57 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/24/2006 12:48:05 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/24/2006 12:38:00 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 12:38:00 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 12:37:30 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 12:37:30 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/24/2006 12:35:40 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/24/2006 12:00:40 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/23/2006 5:55:58 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/23/2006 5:43:36 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/23/2006 5:43:36 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/23/2006 5:43:31 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/23/2006 12:00:39 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/22/2006 7:03:56 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/22/2006 7:02:37 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/22/2006 6:01:36 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/22/2006 6:01:36 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/22/2006 6:01:34 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/22/2006 1:12:32 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/22/2006 12:55:38 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/22/2006 12:55:38 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/22/2006 12:55:38 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/21/2006 2:23:49 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/21/2006 1:18:40 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/21/2006 1:18:40 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/21/2006 1:13:30 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 5:13:50 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 4:53:14 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 4:53:14 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 4:53:02 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 4:22:05 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 2:18:10 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 2:18:10 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 2:15:07 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 11:39:19 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 11:24:22 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/20/2006 11:12:49 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 11:12:48 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/20/2006 11:11:27 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/19/2006 2:49:05 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/19/2006 10:10:45 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/19/2006 10:10:45 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/19/2006 10:10:37 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/19/2006 10:10:35 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/19/2006 10:10:35 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/18/2006 8:59:45 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/18/2006 7:56:37 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/18/2006 7:56:37 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/18/2006 7:56:34 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/18/2006 1:59:17 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/18/2006 1:51:05 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/18/2006 1:51:05 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/18/2006 1:42:31 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/17/2006 2:21:52 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/17/2006 1:17:35 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/17/2006 1:17:35 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/17/2006 1:17:18 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/16/2006 8:38:11 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:18 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:18 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:17 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:17 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:04 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:23:04 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 8:22:55 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/16/2006 2:11:22 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/16/2006 10:32:14 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 10:32:14 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/16/2006 10:31:22 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/16/2006 12:00:39 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/15/2006 3:31:58 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/15/2006 2:47:01 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/15/2006 2:02:21 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/15/2006 2:02:21 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/15/2006 2:01:51 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/15/2006 12:00:41 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 5:33:22 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 5:20:46 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 5:20:46 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 5:19:56 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 5:18:15 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 5:13:57 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 5:13:51 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 5:13:51 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 4:40:10 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 2:28:19 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 2:28:13 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 2:28:13 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 1:54:13 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 1:54:13 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/14/2006 1:37:25 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 1:39:54 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/14/2006 12:00:38 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 6:38:02 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 6:20:37 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 6:20:37 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 6:20:37 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 12:42:13 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 10:55:05 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 10:55:05 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 10:55:04 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 9:02:29 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 7:58:39 AM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 7:58:39 AM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/13/2006 7:57:47 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/13/2006 12:00:40 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/12/2006 3:39:50 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/12/2006 3:32:50 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/12/2006 3:32:42 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 3:32:42 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 1:55:29 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/12/2006 12:57:38 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:57:38 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:57:37 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:57:37 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:54:46 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:54:46 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:54:36 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:54:36 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:51:33 PM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF
Failure Audit 1/12/2006 12:51:26 PM Security Account Logon
680 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 12:51:26 PM Security Logon/Logoff
529 SYSTEM KILL-F1992A9FEF
Failure Audit 1/12/2006 11:34:31 AM Security Policy Change 615 NETWORK
SERVICE KILL-F1992A9FEF

.

Quantcast