Help! I think I'm being hacked!!

[Jonny Yen]

I'm a fairly inexperienced XP Home user - I'm using a machine which is
connected to the internet via a wireless router. After having a look in the
event log I found literally thousands of entries similar to these (the 3rd
one is particularly worrying to me as I know of no one called Peter). Can
anyone suggest what I might need to close off to prevent this happening.
Thanks

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:39:19
User: NT AUTHORITY\SYSTEM
Computer: **************
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: U-QU33LNWRIQYIU
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: U-QU33LNWRIQYIU

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:39:19
User: NT AUTHORITY\SYSTEM
Computer: *********
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: U-QU33LNWRIQYIU
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: U-QU33LNWRIQYIU

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:43:19
User: NT AUTHORITY\SYSTEM
Computer: *******************
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Peter
Domain: PETER_WORK
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: PETER_WORK

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Warren Young]

I'm a fairly inexperienced XP Home user - I'm using a machine which is
connected to the internet via a wireless router. After having a look in the
event log I found literally thousands of entries similar to these (the 3rd
one is particularly worrying to me as I know of no one called Peter). Can
anyone suggest what I might need to close off to prevent this happening.
Thanks

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:39:19
User: NT AUTHORITY\SYSTEM
Computer: **************
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: U-QU33LNWRIQYIU
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: U-QU33LNWRIQYIU

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:39:19
User: NT AUTHORITY\SYSTEM
Computer: *********
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: U-QU33LNWRIQYIU
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: U-QU33LNWRIQYIU

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 01/02/2004
Time: 01:43:19
User: NT AUTHORITY\SYSTEM
Computer: *******************
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Peter
Domain: PETER_WORK
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: PETER_WORK

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

First thing to check is that your wireless router and clients use WEP
and enable MAC address filtering on the router. Secondly, install a
software based firewall such as Zone Alarm.

Warren