What is the Event Viewer telling me?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Lorne (Lorne_Anderson_at_hotmail.com)
Date: 09/07/04 

Date: Tue, 7 Sep 2004 23:20:24 +0100

I just found the event viewer in the program menu under admin tools. When I
click the Security tab it lists what looks like a series of network events.
User is shown as me, system, network services, local service or guest most
of the time. Guest appears to be when another computer on my network (2
other family members) accesses my disk. Event numbers are usually 528 or
576 or 850 or 849 or 680 plus a few others.

My concern is that every few hours there is an entry of event 540 with user
Anonymous Logon ! Properties says logon type = 3 and windows help says that
is somebody on the network logging in, but this is happening when only me is
using the computer and nothing else on the network is switched on.

I have not noticed anything going on that is suspicious but this entry in
the event viewer certainly does look suspicious. I have also seen that in
the applications tab WMDM PMSP Service is starting 2 seconds before every
anonymous login. There is an article about a security hole related to Media
Player & this service but I do have all the critical updates installed as
far as I know.

Have I been hacked or is there an innocent explanation?

Relevant Pages

  • Re: What is the Event Viewer telling me?
    ... >I just found the event viewer in the program menu under admin tools. ... >When I click the Security tab it lists what looks like a series of ... User is shown as me, system, network services, local ...
    (microsoft.public.windowsxp.network_web)
  • What is the event Viewer telling me?
    ... I just found the event viewer in the program menu under admin tools. ... click the Security tab it lists what looks like a series of network events. ... My concern is that every few hours there is an entry of event 540 with user ... Anonymous Logon! ...
    (microsoft.public.windowsxp.basics)
  • Re: Help, Ive been hacked
    ... View and Manage Event Logs in Event Viewer in Windows XP ... > I also see no entries listed of a remote access in the event viewer. ... > Your computer was not able to renew its address from the network ... >> And then check on the Remote Access Connection Manager in Services, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Blue Screen
    ... > You can access Event Viewer by selecting Start, ... I noticed that under ethernet adapters there were like 9 ... >> knew the network cable would be plugged into. ... >> or because it has no enabled devices associated with it. ...
    (microsoft.public.windowsxp.general)
  • Re: workgroup is not accessable; the network is not present or not
    ... The workstation service terminated with service specific error 2250 ... Could not load RDR device driver ... not see any of the other machines on the network. ... > Have you used Event Viewer to see what events or error ...
    (microsoft.public.win2000.networking)