Malicious Attack? Could someone take a look and let me know what you think?

Discussion in 'Computer Security' started by HelenD, May 1, 2007.

  1. HelenD


    May 1, 2007
    Likes Received:
    A few weeks ago, I found that a large number of adult material files appeared on the computer over the weekend when it was not connected to the internet and I was not using the computer. Last week, I found that a similar incident had occurred one week earlier when I did not have the computer but it was connected to the company network.

    From quick analysis I found the following:

    * Both events were bounded by two failed logon attempts under my user ID

    * Time duration between the two failed logon attempts was two days and twenty one hours.

    * Over the time period between the two failed logon attempts on each occasion, 72 event ID 636 and 72 event ID 637 occurred. Event ID 636 is : A user or group account was added to a local security group on the computer or on the domain, and Event ID 637 is: A user or group account was removed from a local security group on the computer or on the domain.

    * MS Installer events occurred post the creation of the adult material files when the computer was next logged onto the network.

    I am interested in knowing whether anyone thinks this is substantial evidence of a virus or malware attack or if these two events are related. It is concerning because I have had virus and malware scanners run across the computer that were available between the 30th March and 4th April and none of these returned the presence of any virus or malware – in particular Symantec Anti-Virus v9., F-Prot v6.0.6.3, Avast! Anti-Virus v4.7.942 and Ad-Aware v1.06r1. Is it possible that they could have missed something? Are you aware of any other malware / viruses that could have demonstrated this behaviour?

    Please find logs and some initial analysis attached. I have separted out the two dates on the last two tabs of the attached excel spreadsheet

    Any help is appreciated,


    Attached Files:

    HelenD, May 1, 2007
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.