Re: Weird Logins
From: asdf (asdf_at_asdf.com)
Date: Thu, 10 Nov 2005 18:24:35 -0500
she is already changing her pass once a week.
thats why i think that it's a keylogger or similar.
"Steven L Umbach" <email@example.com> wrote in message
> Enable auditing of logon events on her computer in Local Security Policy
> then view logon entries in the security log to see what is going on and
> proceed from there. The events will have a logon type and a timestamp.
> 7 shows the computer was unlocked. Make sure you reset her password ASAP
> and you may need to do a clean install of the operating system. ---
> "asdf" <firstname.lastname@example.org> wrote in message
> > one of our users is complaining that someone is loging in to her
> > when she leaves she locks her computer but sometimes when she comes back
> > it is unlocked. Noone else knows her password. Even if i it was reset
> > through active
> > directory it would show since then she would know that someone changed
> > To me that leaves only one option and that is that someone has installed
> > keylogger
> > like spector to get her password. System is running Symantec Corporate
> > Antivirus 9.1
> > but those keylogger have a way of avoiding detection. What are other
> > things
> > that could
> > be causing this. What are other ways of troubleshooting this problem.
> > thanx a million for all the responses.