Still clean after 5 days!
He's only still trying because I had last weekend 659 attempts: 4183 Events failed login in my application log.
The accounts used are: \administrator, \abc, \data, \server, \backup, \www, \web, \master, \test, \root, \admin and \webmaster.
So beware!
First I did the same as johndpatriort wrote on oct 7th.
After that no mail appeared for one day.
This morning it started all over again.
A friend made me a suggestion to look for the local user:
TsInternetUser. We uses Windows 2000 Terminal Server.
This user exists and had no password. So...
It seems that my attacks have been stopped for two days now, due to techniques from this site. Thanks!!
I'm not sure but this morning i was hit again instead of bluestell**@* it uses blueinfo**@*
It uses the admin account although this is not excisting.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.