MonitorWare Knowledge Base

Hi
Can someone confirm that if i started to get a lot of event ID 644 on a domain controller running w2k, locking out most of the active accounts, could it be due to a virus (trojan) ? We have also noticed that some of our PCs having bad/weak passwords have been the target of this particular virus called 'Backdoor.Roxy' virus. Norton's Anti-virus (update 6th aug 03) was used to scan them. Norton's does not report any virus, but its realtime scanner would pick up this virus occassionally. Accounts gets locked out at around the same time as well, which to me indicates that it could be the cause for the lockouts. Also the event ID also indicates these PCs as the source of the lockout (caller name).

Does any one have any idea how to handle this situation ?

murthy

Hi,

could you send the whole event message here?