Re: Logon Attempt Failed (Security Log)

From: Adrian Grigorof (adrian.grigorof)
Date: 05/24/04 

Date: Mon, 24 May 2004 15:09:03 -0400

This could be a service configured on that computer that is using the wrong
user id and password. Check the services running on that machine (and the
accounts they use). I do not exclude some sort of malware - I have seen
trojans running on computers with the latest av updates. Use tje Process
Explorer utility from www.sysinternals.com to see if there are any strange
processes running on that computer. Some trojans may use file names vary
similar to files used by Windows (to confuse you) - for example I have seen
a Trojan using scvhost.exe (very similar to svchost.exe used by Windows). 

-- 
Regards,
Adrian Grigorof
Event Log UnDump: http://www.altairtech.ca/elundump/
www.eventid.net
"Johnb" <anonymous@discussions.microsoft.com> wrote in message
news:118fc01c441bb$3855e6a0$a501280a@phx.gbl...
>
> >-----Original Message-----
> >What is the exact content of the failure audits that you
> get in the event
> >log?
> >-- 
> >Regards,
> >Adrian Grigorof
> >www.eventid.net
> >Event Log UnDump: http://www.altairtech.ca/elundump/
> >
> >"Johnb" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:1160f01c441b1$17d5f050$a301280a@phx.gbl...
> >> I need help.
> >> About 4 to 5 'Failed logon attempts' a day have been
> >> logged on my computer for the last three weeks.  The
> event
> >> identifies the workstation within our LAN that is
> >> attempting the logon.  However, the event is logged even
> >> when that person is not present.  I suspect a virus of
> >> some kind but regular weekly scans have not detected
> any.
> >> I have kept the virus files (Norton) updated on a daily
> >> basis.
> >> How do I identify what is causing the logon attempts and
> >> more importantly, how do I correct it.
> >>
> >>
> >
> >
> >.
> >The windows displays:
> Date    5/24/04       Source      Security
> Time      .....       Category     Account Logon
> Type     Failure      Event ID:    681
> User     NT Authority\System
> Computer S.....
> Description
> Logon Failure
>       Reason:         Unknown user name or password
>       User Name:      M.....
>       Domain:         DTN
>       Logon Type:     3
>       Logon Process:  NtLmSsp
>       Aut...Package:  NTLM
>

Relevant Pages