Results 1 to 4 of 4

Thread: Hacker?

  1. #1

    Question Hacker?

    The event viewer on my Windows 2k Server shows someone trying to logon every day for the past ten days. It seems the attempts occur every few seconds for about ten minutes. A few usernames are used and the error message given refers to an invalid username or password. If anyone is familiar with this kind of attack please post a reply.
    Thanks

    examples:
    The logon to account: TsInternetUser
    by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    from workstation: KUNG-73E1LAGTCD
    failed. The error code was: 3221225578

    The logon to account: IWAM_IXIQANBM
    by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    from workstation: KUNG-73E1LAGTCD
    failed. The error code was: 3221225578

  2. #2
    You might like to try one of the security mailing lists. Someone on there may have more chance of coming across this problem and would be more likely to help you.
    Example http://online.securityfocus.com/archive
    web:http://www.allabouthosting.co.uk
    email: sales@allabouthosting.co.uk

  3. #3

    Thanks

    Thanks for the help, I'll look into it.

  4. #4
    Join Date
    Nov 2002
    Posts
    22
    sounds like an brute force attack you dont happen to be running an porn site do you kiddies are really bad bout trying to crack there way into them to get free access and did all the attacks came from the same ip or were they spoofed if they all came from the same ip the odds is pretty good he didnt know what he was doing and didnt spoof his ip so i would send the logs to the abuse center where your geting your server from they should be able to track him down for you
    take care

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •