Event Viewer Security Logs: Intruder Detected

  • Thread starter =?iso-8859-1?B?PyBULVJleCA/?=
  • Start date
?

=?iso-8859-1?B?PyBULVJleCA/?=

Let me start off with my OS: Windows XP Home Edition.
I'm an ITT Tech student and have in-depth knowledge of
computers and networking. Recently, I've found in my
security logs in the event viewer that there have been
several attempts at gaining access to my machine. These
are NOT local attempts, because the domains these
attempts came from differ from my own.

Here's the mystery part of the problem. I'm on a dial-up
modem. Now... everyone knows a dial-up modem is a moving
target since its IP address is dynamic, meaning it isn't
the same IP address everytime. The access attempts were
made over the course of 2 weeks! Meaning they must know
exactly where to find my computer when they want another
crack at it.

Another troubling aspect of this is that the logon
attempts are coming from 22 different DOMAINS! This means
that there are potentially 22 different people trying to
hack my machine. I highly doubt this is the case, due to
the fact that the user names used for every domain are
the same. Every domain used user names such as
administrator, admin, guest, user, test, root, teacher,
student, and someone even used an actual name... pretty
stupid if it's THEIR name. This issue has me totally
puzzled. If anyone has any suggestions or perhaps a site
or person I could report this incident to, please let me
know.

For now, I'm not that concerned because these seem like
lame attempts at gaining access (some wannabe hacker kid
prolly). The time stamp on each attempt suggests that
whoever is doing this is doing it manually... meaning
they aren't using any brute force or dictionary password
crackers, they didn't bother clearing the logs, and a
real hacker doesn't waste their time on personal/home
stand-alone desktop computers. I've since turned on my
built in firewall and been keeping close tabs on what
connects to my machine, so I'm fine for now... but
please... any help is appreciated. Thanks.


? T-Rex ?
 
Z

zylox

Ok this doesn't seem right. I'm experiencing the same
problem, and I can tell you it's not a port sniffer. Each
security alert is a bad username/password error. The time
stamps for my attacks are rapidly consecutive. I mean 60-
90 per minute. That is not a manual attempt.
 
T

T-Rex

Well... I thank you for your help, Roger Abell, though I
fail to see how you interpretted that I think me and my
machine are "special". As a matter of fact, I noted how
UNspecial my machine was when I said that real hackers DO
NOT bother with home users. My machine is by no means an
inticing target for I have nothing anyone would want. And
as for a firewall... which seems to have been suggested
by everyone in reply to my post... I noted at the end of
my post that I HAVE enabled my firewall and it HAS
thwarted these attempts. I do appreciate your advice and
information, and thanks. And yes, to those that believe
it's one person doing this even though the attempts are
coming from 22 different domains, I know this... and even
stated that in my post. Sorry for the attitude, but
please concider the replies I received.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top