A question

Anonther question.
What if I see on the event viewer in the security in administration tool, logon/logoff
NT authority\anonymous logon

Does it mean someone tried to hack my computer?
How can trace back the one trying to logon to my computer?

Most likely you have a trojan on your system. To keep this simple, a person who cracks into your pc, if interested enough to come back, would install a program that would periodically broadcast your ip to this person. Also, having a backdoor installed, they would most likely get access to your pc.

A few suggestions,

A firewall would help. If you have a perminant connection to the internet, you'll want a firewall. Either a software or hardware one would work. Your firewall (or if you're too cheap to get one, run netstat) will keep a log of the IP's trying to connect to you. Just block the IPs, and you should be a lot safer.

Also, get a good anti virus program and run it daily. Big culprits of security risk are things like illegal programs, unethical sights, etc. IRC is another culprit for risk.

Finally, NEVER, and I mean NEVER, run as administrator. I don't care if you're the only person on the computer, and if it makes your life a living **** because you can't install anything. I'd say the majority of the people who get in trouble with viruses, etc, get in trouble, because they create an account with administrator priveleges. Set up your main account to have lesser priveleges. I mean, how often do you really install programs into areas that should be secure, such as the windows system directory?

Granted, a person who really wants to get into your pc will find a way. It's unavoidable. But the amount of people trully with this knowledge are probably as common as people who can optimizie assembly better than a compiler. The majority of people who crack just use other people programs, and leave a lot of their information lieing right in the open.

A good chunk of machines I've seen compromised were first done by some idiot opening a trojan on the computer, which transmitted the computer's details to the attacker, who then raids the computer at their leisure now that the trojan has opened a nice wide gaping orifice.

The IP probably won't change if you're on a permanent connection like cable or DSL; I don't think my home IP address has changed in the last month. In any event, this theoretical trojan would probably re-send the new IP address to the attacker.

It's possible you could scan for random victim IPs by going through the IP listings on forums, but this seems like a waste of time since you'd then need to attack those machines, which requires a vulnerability and perhaps some intelligence. Most script kiddies just aren't that bright.

Some of the modern worms just pick a random IP address and bang on the door of the vulnerability; but that's hardly an attacker and more like a dumbass script.

My overall advice: Don't run as administrator, virus scan things before you open them, and goddammit, just don't open random things.

Quote:

Original post by Ravuya and goddammit, just don't open random things.

QFT.

Quote:

Original post by tstrimp Quote: Original post by Ravuya and goddammit, just don't open random things. QFT.

what is QFT?

(and while we are on it)
and RCII or something like that

Quote:

Original post by wizardpc Quote: Original post by tstrimp Quote: Original post by Ravuya and goddammit, just don't open random things. QFT. what is QFT? (and while we are on it) and RCII or something like that

QFT means Quoted For Truth (EDIT: Fixed).
I don't know of anything called RCII, how was it used in a sentence?

Next time just look it up on acronymfinder.com.

Quote:

Original post by CTar I don't know of anything called RCII, how was it used in a sentence?

They probably ment IIRC, which is If I Recall Correctly.

Trojan would be the way to go, but If you have a wireless router, make sure you lock that down.