Malicious Attack? Could someone take a look and let me know what you think?

Discussion in 'Computer Security' started by HelenD, May 1, 2007.

  1. HelenD

    HelenD

    Joined:
    May 1, 2007
    Messages:
    1
    A few weeks ago, I found that a large number of adult material files appeared on the computer over the weekend when it was not connected to the internet and I was not using the computer. Last week, I found that a similar incident had occurred one week earlier when I did not have the computer but it was connected to the company network.

    From quick analysis I found the following:

    * Both events were bounded by two failed logon attempts under my user ID

    * Time duration between the two failed logon attempts was two days and twenty one hours.

    * Over the time period between the two failed logon attempts on each occasion, 72 event ID 636 and 72 event ID 637 occurred. Event ID 636 is : A user or group account was added to a local security group on the computer or on the domain, and Event ID 637 is: A user or group account was removed from a local security group on the computer or on the domain.

    * MS Installer events occurred post the creation of the adult material files when the computer was next logged onto the network.

    I am interested in knowing whether anyone thinks this is substantial evidence of a virus or malware attack or if these two events are related. It is concerning because I have had virus and malware scanners run across the computer that were available between the 30th March and 4th April and none of these returned the presence of any virus or malware – in particular Symantec Anti-Virus v9.0.0.33.8, F-Prot v6.0.6.3, Avast! Anti-Virus v4.7.942 and Ad-Aware v1.06r1. Is it possible that they could have missed something? Are you aware of any other malware / viruses that could have demonstrated this behaviour?

    Please find logs and some initial analysis attached. I have separted out the two dates on the last two tabs of the attached excel spreadsheet

    Any help is appreciated,

    HelenD
     

    Attached Files:

    HelenD, May 1, 2007
    #1
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. fred_7038@yahoo.com
    Replies:
    8
    Views:
    579
    goofy@nowhere.com
    Sep 15, 2005
  2. Dan
    Replies:
    6
    Views:
    450
    WebKatz
    Nov 5, 2003
  3. Joseph a Photo Galleries

    Check out my site (let me know what you think)

    Joseph a Photo Galleries, Aug 26, 2006, in forum: Digital Photography
    Replies:
    8
    Views:
    355
    Helen
    Aug 26, 2006
  4. Evan Platt

    Let Google know what you think.

    Evan Platt, Sep 18, 2007, in forum: Computer Support
    Replies:
    9
    Views:
    649
    thanatoid
    Oct 24, 2007
  5. Daniel
    Replies:
    2
    Views:
    407
    Daniel
    May 11, 2004
Loading...

Share This Page