Very strange username ...

[Thomas]

Hello all,

I get this eventid on our proxy-server:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 09/02/2004
Time: 15:34:20
User: NT AUTHORITY\SYSTEM
Computer: *****
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: dsgsgsdgirghrhefhgdu
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: *****

Any idea if this is a hacker? I don't think so because of the 'Advapi', but
which program is trying to log on with this strange username???: User Name:
dsgsgsdgirghrhefhgdu

 

[Bobby McMillan [MSFT]]

Thomas,

It is difficult to say if this is a "hacker" do you have control over the
computer that is listed in the event? If so take a look there. This
event just states that dsgsgsdgirghrhefhgdu attempted to logon over the
network. How often does this happen?


This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "Thomas" <[email protected]>
| Subject: Very strange username ...
| Date: Mon, 9 Feb 2004 11:07:52 +0100
|
| Hello all,
| I get this eventid on our proxy-server:
| Event Type: Failure Audit
| Event Source: Security
| Event Category: Logon/Logoff
| Event ID: 529
| Date: 09/02/2004
| Time: 15:34:20
| User: NT AUTHORITY\SYSTEM
| Computer: *****
| Description:
| Logon Failure:
| Reason: Unknown user name or bad password
| User Name: dsgsgsdgirghrhefhgdu
| Domain:
| Logon Type: 3
| Logon Process: Advapi
| Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
| Workstation Name: *****
| Any idea if this is a hacker? I don't think so because of the 'Advapi',
but
| which program is trying to log on with this strange username???: User
Name:
| dsgsgsdgirghrhefhgdu
|

 

[Thomas]

Thx fot you reply,

Yes I have control over the server.
I get this events at these times:

09-02-04: 9h48

08-02-04: 15h23

05-02-04: 17h16

05-02-04: 9h16

04-02-04: 12h35

02-02-04: 20h51

So there is really nog logica in all these times ....

There are 2 programs running on the server: Vpop3 and Proxy+, but I don't
think it are those programs that are causing these strange events.

Any idea?

 

[Bobby McMillan [MSFT]]

Thomas,

I would start by making sure you are protected against intrusions from the
internet. Is this s secure network? On your firewall, what ports need to
be closed. If this is a protected network, and you are sure that this is
not coming from an external source, you may wish to investigate the use of
netlogon.log.

109626 Enabling Debug Logging for the Net Logon Service
http://support.microsoft.com/?id=109626



This posting is provided "AS IS" with no warranties, and confers no rights.