Logon Attempt Failed (Security Log)

  • Thread starter Thread starter Johnb
  • Start date Start date
J

Johnb

I need help.
About 4 to 5 'Failed logon attempts' a day have been
logged on my computer for the last three weeks. The event
identifies the workstation within our LAN that is
attempting the logon. However, the event is logged even
when that person is not present. I suspect a virus of
some kind but regular weekly scans have not detected any.
I have kept the virus files (Norton) updated on a daily
basis.
How do I identify what is causing the logon attempts and
more importantly, how do I correct it.
 
-----Original Message-----
What is the exact content of the failure audits that you get in the event
log?
--
Regards,
Adrian Grigorof
www.eventid.net
Event Log UnDump: http://www.altairtech.ca/elundump/




.
The windows displays:
Click to expand...
Date 5/24/04 Source Security
Time ..... Category Account Logon
Type Failure Event ID: 681
User NT Authority\System
Computer S.....
Description
Logon Failure
Reason: Unknown user name or password
User Name: M.....
Domain: DTN
Logon Type: 3
Logon Process: NtLmSsp
Aut...Package: NTLM
 
This could be a service configured on that computer that is using the wrong
user id and password. Check the services running on that machine (and the
accounts they use). I do not exclude some sort of malware - I have seen
trojans running on computers with the latest av updates. Use tje Process
Explorer utility from www.sysinternals.com to see if there are any strange
processes running on that computer. Some trojans may use file names vary
similar to files used by Windows (to confuse you) - for example I have seen
a Trojan using scvhost.exe (very similar to svchost.exe used by Windows).
 
The ERROR window displays:
Date 5/24/04 Source Security
Time ..... Category Account Logon
Type Failure Event ID: 681
User NT Authority\System
Computer S.....
Description
Logon Failure
Reason: Unknown user name or password
User Name: M.....
Domain: DTN
Logon Type: 3
Logon Process: NtLmSsp
Aut...Package: NTLM
Thanks,
Johnb
 
Back
Top