Hacking attempt - Windows server 2003

Question

I'm seeing some hacking attempts on my office PC. Last Friday my PC restarted twice suddenly and when I logged in, some of my important documents were not there. Just deleted. So I checked the Event Viewer to find the reason about this restart. I got these logs and I see someone's PC name on that logs. Can anybody explain this to me?

Thank you!

Date:7/27/2012   Source:Security
Time:2.35.26 PM Category:Account Logon
Type:Success A  Event ID:680
User:MyPC/Administrator
Computer: MyPC
Description:
  Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Logon Account:Administrator
  Source Workstation:OtherPC
  Error Code:0x0

Date:7/27/2012   Source:Security
Time:2.35.26 PM Category:Logon/Logoff
Type:Success A  Event ID:576
User:MyPC/Administrator
Computer: MyPC
Description:
   Special privileges assigned to new logon:
   User Name:Administrator
   DOMAIN: MyPC
   Logon ID: (0x0, 0x251E985)
   Privileges:SeSecurityPrivilege
   SeBackupPrivilege
   ...

Date:7/27/2012   Source:Security
Time:2.35.26 PM Category:Logon/Logoff
Type:Success A  Event ID:540
User:MyPC/Administrator
Computer: MyPC
Description:
   Successful Network Logon:
   User Name:Administrator
   DOMAIN: MyPC
   Logon ID: (0x0, 0x251E985)
   Logon Type:3
   Logon Process:NtLmSsp
   Authentication Package:NTLM
   Workstation Name:OtherPC
   Logon GUID:-
   Caller User Name:-
   Caller Domain:-
   Caller Logon ID:-
   Caller Process ID:-
   Transited services:-
   Source Network Address:192.168.x.x
   Source Port:0

Date:7/27/2012   Source:Security
Time:2.35.26 PM Category:Logon/Logoff
Type:Success A  Event ID:551
User:MyPC/Administrator
Computer: MyPC
Description:
   User initiated logoff:
   User Name:Administrator
   DOMAIN: MyPC
   Logon ID: (0x0, 0x2059c)

score 1 · Accepted Answer · answered Jul 30 '12 at 15:51

1

Have you edited these logs in any way other than changing names of computers to "MyPC" and "OtherPC"? For example, in Event Viewer, the Source should be "Security", not "Secirity". This makes me question the validity of these logs.

In any case, Event ID 540 is a remote connection being made to your computer, in this case, from OtherPC. Given OtherPC's IP address, it appears to be within your network. Do you have access to OtherPC? Can you give us the Event Viewer logs from OtherPC as well?

All in all, nothing here looks too out of order. The first and last logs are standard logon and logoff logs. The second fairly commonly follows logon logs. And we can't know much more about the third without more information.

answered Jul 30 '12 at 15:51

alexgerst

155
1
11

It's my mistake. I wrote down these things. I changed the names to 'MyPC' and 'OtherPC'. And I can't access to the 'OtherPC'. So what kind of information you need? – sura2k Jul 31 '12 at 01:25
1

Honestly, there isn't much more information that will help without access to the other PC. My only advice is to make sure you have an up to date firewall. Talk to your management/IT department if you haven't already. Seems particularly suspicious that it was an internal computer that connected to you. – alexgerst Jul 31 '12 at 14:19
Thank you very much. I just wanted a suggestion and I got one. – sura2k Aug 01 '12 at 09:23

Hacking attempt - Windows server 2003

1 Answers1