Re: c:\Documents and Settings\NetworkService

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 11/29/05 

Date: Mon, 28 Nov 2005 23:20:25 -0600

The networkservice is a profile created by the operating system as explained
in the text below from Microsoft documentation at the link below. If you
look at your services using services.msc you will see that some services use
the network service account for logon which is much more secure than
"system" that was probably used for the same service in Windows 2000.
System is all powerful on the computer while network service is much more
limited. What may have happened is that cookies were written there in an
attempt to hide them from removal tools or using IE to delete cookies.
Administrators has full control to the networkservice profile and those
cookies may have been written there while you were logged on as an
administrator and browsing the internet. It is good idea to create a regular
user account for internet browsing and reading email. In addition to using
AdAware you should scan for viruses with a quality antivirus program using
the latest definitions form the vendors website. Spyware would not be able
to stop the EventLog service but a virus could or if someone installed a
backdoor/trojan on your computer they may be doing it to prevent events from
being written to the security log. --- Steve

http://www.microsoft.com/windowsserver2003/community/centers/management/manage_faq.mspx
http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx
 --- Protect Your PC
http://www.microsoft.com/athome/security/viruses/default.mspx --- info on
viruses and worms.

NetworkService and LocalService. The LocalService and NetworkService
profiles are automatically created by Windows XP for two new built in user
accounts that are used by the Service Control Manager to host services that
do not need to run as the local system account. These profiles are required
by the system to run and should not be modified. Both of these profiles are
hidden by default

"Geranium" <notvalid@nospam.org> wrote in message
news:GSDif.1527$zc1.843@amstwist00...
> Hello!
>
> Ad-Aware found cookies in a cache below a directory/user I did not know
> existed:
> c:\Documents and Settings\NetworkService.
>
> What is the directory NetworkService used for? The directory is not seen
> in Windows Explorer even when folder options is set to show everything.
> One of these cookies was from a gaming web that I did not visit at the
> time of the cookie creation. A few hours earlier my eventlogger shut down
> for three seconds and som windows popped on my screen. I visited
> www.adelphia.net just before this and it went kind of slow there. I do not
> know if these things are connected with each other.
>
> Ad-Aware did not find any other stuff than cookies.
>
> I use Windows XP.
>
> From sys eventlog
> 2005-11-28,01:11:06,EventLog,Information,None,6005,N/A,mycomputer,The
> Event log service was started.
> 2005-11-28,01:11:06,EventLog,Information,None,6009,N/A,mycomputer,Microsoft
> (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.
> 2005-11-28,01:10:03,EventLog,Information,None,6006,N/A,mycomputer,The
> Event log service was stopped.
> 2005-11-28,00:19:31,Tcpip,Warning,None,4226,N/A,mycomputer,TCP/IP has
> reached the security limit imposed on the number of concurrent TCP connect
> attempts.
>
> I use firewall and anti-virus and the firewall stopped logging at 00:44
>
>
> Has something bad happened to my computer? Intrusion?
>
>
>
> Thanks in advance.
>
>
>

Relevant Pages