Am I been Attacked? 2

[deperado]

I am the administrator of a 300 desktop Windows network, i have implemented account policies that lockout accounts after "3" incorrect passwords.

Recently i have had 30 - 40 accounts being locked out in just a few days, this to me looks suspicious and require some assistance on how to find out what is causing this to happen.

Having looked in the event viewer i can see ramdom user accounts are being locked as a result of the policy and having spoken to the users, they say they havent entered the passwords incorrectly.

This is what makes me believe that there may be someone running a piece of account password software.

How can i find which pc if any is responsible?

Any help would be appreciated.

 

[Salem]

Assuming someone isn't deliberately walking around the office typing in passwords just to lock people out, you could use a network monitoring tool to watch traffic on the network.

This is the tool I use for watching local traffic

http://www.ethereal.com/

With 300 machines, you're going to generate a lot of traffic. Ethereal can filter what it records according to all sorts of rules, so my suggestion would be to record a network login attempts (good and bad?) and set up a filter which matches that.

Once your filter is set, you should be able to spot login attempts.
Since the event log and ethereal timestamp data, you should be able to match up events in one with events in the other.

--

 

[lasmith05]

Would Ethereal be comparable to Sniffer in terms of functionality?

 

[deperado]

thanks for your help, i ran spybot on all the machines that were locking out and found one without Sophos on it, loaded sophos and it found a trojan/spyagen.c had effected ntinvisble file, shredded file but cant find any lit on this trojan, not even on sophos site, any ideas what it is?

Your help is appreciated.

 

[crow053]

could this be it?

http://www.spytech-web.com/spyagent.shtml

Sounds like you have a keylogger. There is a product called anti-keylogger (I believe) that is free to try. Look in google

 

[Xemus]

Check this out too. Manual removal instructions from Pest Patrol.

http://www.pestpatrol.com/PestInfo/s/spyagent.asp

http://www.closedsocket.com