MonitorWare Knowledge Base

Hi,

I have just posted a new paper on Windows password attacks as well as other suspicious activity that might be worth tracking:

http://www.monitorware.com/Common/en/Articles/Detecting-Password-Attacks-Windows.asp

Rainer

I am currently having this problem on my network. Can anyone point me in the right direction on how to determine where these attacks are coming from and how I can stop them. I have a PIX firewall with just about every port closed, I am running a packet sniffer on the same segment as the server and I can not figure out where it is coming from. Any help would be appreciated.

Tom

If you would like to provide us with your log files (you can export them with event viewer), we could look into it and see if we can find anything intelligent out of it. If you would like to do so, please email to support @ adiscon.com - that should be handled privately for security reasons.

Rainer

Thanks for the help; the file is on it's way.

Tom