Re: am I being hacked or is something else going on?

From: Gary Massengale (garym_jnospam_at_hotmail.com)
Date: 05/21/04 

Date: Fri, 21 May 2004 09:40:08 -0400

yes, it is on the local network. I have tested our firewall and cannot
find any unnecessary ports open, and we have a coporate antivirus solution
and the scans dont show infection on any of our PCs, and I will also try
your suggestions also,thanks.

One other thing, if it is somebody on our local network trying this, how can
I track down which workstation this person is using?

gary

"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:LLbrc.87773$iF6.7516024@attbi_s02...
> Are you on a local network with other computers? Type 3 logon means
someone is trying
> to gain access from the network. Do you have any holes open in your
firewall to offer
> services to internet users such as a web server? I would suggest running
Microsoft
> Baseline Security Analyzer on your computer to check for vulnerabilities
including
> unneeded services and scan your firewall from a self scan site such as
> http://scan.sygatetech.com/ to make sure it is not misconfigured and
disable file and
> print sharing if you are not offering shares to other computers on a
network. Be
> sure to do a full virus scan with latest definitions if you have not done
that
> yet. --- Steve
>
> http://www.microsoft.com/technet/security/tools/mbsahome.mspx
> http://www.microsoft.com/security/protect/
>
> "Gary Massengale" <garym_jnospam@hotmail.com> wrote in message
> news:OveepMpPEHA.556@tk2msftngp13.phx.gbl...
> > event viewer is showing unsuccesful login attemps, sometimes user name
is "
> > server ", sometimes " abc ", sometimes " data ". I have current
antivirus,
> > and a firewall running, so I am curious as to what is causing these
attempts
> > at 2 AM in the morning.
> >
> > Below is what I keep seeing:
> >
> >
> > Event Type: Failure Audit
> >
> > Event Source: Security
> >
> > Event Category: Logon/Logoff
> >
> > Event ID: 529
> >
> > Date: 5/20/2004
> >
> > Time: 2:04:10 AM
> >
> > User: NT AUTHORITY\SYSTEM
> >
> > Computer: MYSERVERNAME
> >
> > Description:
> >
> > Logon Failure:
> >
> > Reason: Unknown user name or bad
password
> >
> > User Name: server
> >
> > Domain:
> >
> > Logon Type: 3
> >
> > Logon Process: Advapi
> >
> > Authentication Package:
> > MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> >
> > Workstation Name: MYSERVERNAME
> >
> >
>
>

Relevant Pages

  • [hardware] gigabit firewall
    ... I need some help finding the right hardware for a gigabit firewall. ... mixed 100/1000 MBit backbone ... in the local network ... I just measured the current packets/sec and packet sizes on ...
    (comp.security.firewalls)
  • Re: Local Network or Internet?
    ... You shouldn't make any changes in your router, since its firewall is ... designed to keep the Internet out, not the local network. ...
    (microsoft.public.windowsxp.network_web)
  • Is SP2 a Disaster for XP and Local Networks?
    ... not a smooth transition with respect to my local network and firewall capabilities. ... firewall, Norton's Nav, Mozilla browser/mailer, spybot and flying along pretty well. ... reach my other two computers on my local network. ... Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA) ...
    (microsoft.public.windowsxp.network_web)
  • Re: Network not present or not started
    ... computers/directories my side of the firewall on the Local Network. ... I've actually solved the problem by doing a full scale repair on the Windows ... > | Outgoing mail is certified Virus Free. ...
    (microsoft.public.win2000.setup)
  • Re: am I being hacked or is something else going on?
    ... In event ID 529 the last line is the workstation that the bad logon attempt came from ... I have tested our firewall and cannot ... > One other thing, if it is somebody on our local network trying this, how can ...
    (microsoft.public.win2000.security)