Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

ANONYMOUS LOGON Vista Premium, should I be worried?

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 10-18-2008
Robban
 

Posts: n/a
ANONYMOUS LOGON Vista Premium, should I be worried?
I get up to 50 logins a day on from all different IPs. Particularly one IP
keeps reoccuring in the list and that computer is (according to the IP, we
got our own network here) a neighbour to me. However, the neighbour IP is
still only accounting for roughly 25% of all 'succesful' logins to the
anonymous account.

Sometimes the IP is shown as logged in for just a minute before logged out
and other times its logged in for up to 30 minutes before the logout event
appears.

I bought Vista in June 2008 and going through my security log shows that
this all started from 5th of October 2008.

The following is Event ID 4624 and in swedish.
-------------------------------------------
En inloggning har skett på ett konto.

Subjekt:
Säkerhets-ID: NULL SID
Kontonamn: -
Kontodomän: -
Inloggnings-ID: 0x0

Inloggningstyp: 3

Ny inloggning:
Säkerhets-ID: ANONYM INLOGGNING
Kontonamn: ANONYM INLOGGNING
Kontodomän: NT INSTANS
Inloggnings-ID: 0x565d250
Inloggnings-GUID: {00000000-0000-0000-0000-000000000000}

Processinformation:
Process-ID: 0x0
Processnamn: -

Nätverksinformation:
Arbetsstationens namn: DITT-7HUK3O9FM5
Källnätverksadress: XXX.XXX.XXX.XXX
....
-------------------------------------------------------


/Rob
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 10-18-2008
Ollis
 

Posts: n/a
RE: ANONYMOUS LOGON Vista Premium, should I be worried?


"Robban" wrote:

> I get up to 50 logins a day on from all different IPs. Particularly one IP
> keeps reoccuring in the list and that computer is (according to the IP, we
> got our own network here) a neighbour to me. However, the neighbour IP is
> still only accounting for roughly 25% of all 'succesful' logins to the
> anonymous account.
>
> Sometimes the IP is shown as logged in for just a minute before logged out
> and other times its logged in for up to 30 minutes before the logout event
> appears.
>


I seems that your machine has been compormised and is acting as a host to
some kind of remote control of the machine.

You should flatten the HD if you determine that it has been compormised.

<http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and_Rootkit_Tools_i n_a_Windows_Environment.html>

Reply With Quote
  #3 (permalink)  
Old 10-20-2008
Robban
 

Posts: n/a
RE: ANONYMOUS LOGON Vista Premium, should I be worried?
Just checking if this could happen without the computer being compromised.
Since I couldn't find any info on Google or even here I decided to go with
your advice and flatten the HD and now all is back to pre 5th october. No
more Anon logins as far as my log shows.


Cheers,
Rob



"Ollis" wrote:

>
>
> "Robban" wrote:
>
> > I get up to 50 logins a day on from all different IPs. Particularly one IP
> > keeps reoccuring in the list and that computer is (according to the IP, we
> > got our own network here) a neighbour to me. However, the neighbour IP is
> > still only accounting for roughly 25% of all 'succesful' logins to the
> > anonymous account.
> >
> > Sometimes the IP is shown as logged in for just a minute before logged out
> > and other times its logged in for up to 30 minutes before the logout event
> > appears.
> >

>
> I seems that your machine has been compormised and is acting as a host to
> some kind of remote control of the machine.
>
> You should flatten the HD if you determine that it has been compormised.
>
> <http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and_Rootkit_Tools_i n_a_Windows_Environment.html>
>

Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Vista Premium - ISP a/c Logon Password RJK microsoft.public.internetexplorer.general 0 08-26-2008 09:29
Cosidering Vista, Worried about Software Issues JCO microsoft.public.windows.vista.installation setup 9 06-11-2007 16:46
New to Vista, worried about security joseph_m_ross@yahoo.com microsoft.public.windows.vista.security 14 05-27-2007 10:43
[Info-Buen Tip] How to change default logon domain name in the logon screen Javier Ingls [MS MVP] microsoft.public.es.windowsvista 0 04-03-2007 08:14
Vista Business, IIS and Anonymous access =?Utf-8?B?SnVvemFzIERvdnlkYWl0aXM=?= microsoft.public.windows.vista.networking sharing 0 01-24-2007 18:34




All times are GMT +1. The time now is 19:05.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120