D
DEBBIE
I am new to computing, and I need help in understanding
this. I use windows xp, I also have used Norton (NIS) for
my firewall, and antivirus program. I update both windows
and my virus def regularly. I looked in my computer event
logs and this has come up, I don't know what this means,
and if it is a security problem, I don't know what to do
about it. The event logs starts from 11/6/2003 to
1/31/2004. I have had norton in place since Aug. 2003.
This is what some of the logs show:
11/6/2003 User/NT Auuthority/System Catergory Policy
Change
Description
AUDIT POLICY
NEW POLICY
Success Faliure
+ + Logon/logoff
- - Object access
- - Privilege use
+ + Account Mangement
+ + Policy Change
+ + System
- - Detailed Tracking
Change By
computer #$
Domain Name computer name
Logon ID (0x00,0x3E7
1/31/2004 Soure Security
Time 2:49:03 AM Category Policy Change
Type Failure Audit Event ID: 615
User NT Authority/Network Service
Computer My Computer Name
Description:
IPSEC Services: IP Sec Services failed to get complete
list of Network Inteface on this machine. This can be a
potential security hazard since some of the network
interfaces may not get the protection as desired by the
applied IPSEC filters. Please run Ip Sec monitor snap in
to further diagnose the problem.
1-28-2004 Source Security
Time 7:11:46 PM Catergory Logon/Logoff
Type Success A Event ID 528
User NT Authority/Network Service
Computer My computer #
Description
User Name Network Service
Domain Nt Authority
Logon ID (0x0,0x3E4)
Logon Type 5
Logon Process ADVAPI
Authentication Package: Negotiate
Logon Guid: a lot of 0's
1-28-2004 Source Security
Time 7:08:09 PM Category Logon/Logoff
USER NT Authority/Anonymous Logon
Computer My computer #
Description
Successful Network Logon
USER NAME:
Domain:
Logon ID (0x0x29493)
Logon Type 3
Logon Process NtLmSsp
Authentication Package NTLM
Workstation Name
Logon Guid: a lot of 0's
Some descriptions say:
A trusted logon process has registered with the local
securiy authority. This login process will be trusted to
submit logon requests.
Logon Process Name: Winlogon/MSGina
Never has same logon process name
Can anyone tell if my computer has been hacked into, and
if so what can I do to rectify the situation. Please
forgive my ignorance on computing? I run a virus check
twice a week and have run a computer security check using
Symantec often. The antivirus scans always shows no virus,
and the security checks always say my computer is safe and
shows it's stealth. Thank you in advance for your reply
and for any advice you can share with me on this matter.
Debbie
this. I use windows xp, I also have used Norton (NIS) for
my firewall, and antivirus program. I update both windows
and my virus def regularly. I looked in my computer event
logs and this has come up, I don't know what this means,
and if it is a security problem, I don't know what to do
about it. The event logs starts from 11/6/2003 to
1/31/2004. I have had norton in place since Aug. 2003.
This is what some of the logs show:
11/6/2003 User/NT Auuthority/System Catergory Policy
Change
Description
AUDIT POLICY
NEW POLICY
Success Faliure
+ + Logon/logoff
- - Object access
- - Privilege use
+ + Account Mangement
+ + Policy Change
+ + System
- - Detailed Tracking
Change By
computer #$
Domain Name computer name
Logon ID (0x00,0x3E7
1/31/2004 Soure Security
Time 2:49:03 AM Category Policy Change
Type Failure Audit Event ID: 615
User NT Authority/Network Service
Computer My Computer Name
Description:
IPSEC Services: IP Sec Services failed to get complete
list of Network Inteface on this machine. This can be a
potential security hazard since some of the network
interfaces may not get the protection as desired by the
applied IPSEC filters. Please run Ip Sec monitor snap in
to further diagnose the problem.
1-28-2004 Source Security
Time 7:11:46 PM Catergory Logon/Logoff
Type Success A Event ID 528
User NT Authority/Network Service
Computer My computer #
Description
User Name Network Service
Domain Nt Authority
Logon ID (0x0,0x3E4)
Logon Type 5
Logon Process ADVAPI
Authentication Package: Negotiate
Logon Guid: a lot of 0's
1-28-2004 Source Security
Time 7:08:09 PM Category Logon/Logoff
USER NT Authority/Anonymous Logon
Computer My computer #
Description
Successful Network Logon
USER NAME:
Domain:
Logon ID (0x0x29493)
Logon Type 3
Logon Process NtLmSsp
Authentication Package NTLM
Workstation Name
Logon Guid: a lot of 0's
Some descriptions say:
A trusted logon process has registered with the local
securiy authority. This login process will be trusted to
submit logon requests.
Logon Process Name: Winlogon/MSGina
Never has same logon process name
Can anyone tell if my computer has been hacked into, and
if so what can I do to rectify the situation. Please
forgive my ignorance on computing? I run a virus check
twice a week and have run a computer security check using
Symantec often. The antivirus scans always shows no virus,
and the security checks always say my computer is safe and
shows it's stealth. Thank you in advance for your reply
and for any advice you can share with me on this matter.
Debbie