Hi All,
We've noticed hundreds of failed logon attempts appear on the DC over the last 24 hours. Event ID below:
"Logon attempt by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
Logon account: `bjeiVlak[]Y_bUUbY
Source Workstation: Workstationname
Error Code: 0xC0000064"
The Workstation name is genuine but the logon account certainly isn't. This has been happening for about 60 machines. Our Workstations are Windows XP SP3 and the Servers run Windows Server 2003 R2.
We've scanned all the machines with Sophos and it removed xCmdSvc from the system32 directory on the XP desktops, but it then comes back. I guess we have a worm somewhere on the network but we can't seem to stop it propagating and remove it.
The Firewall to the outside world has always had port 445 blocked so i'm not sure it's replated to the iraq oil worm that's prominent on most searches.
I've enabled logon auditing on the DC and netlogon.log shows hundreds of lines very similar to the below:
10/02 15:26:19 [LOGON] ADMIN: SamLogon: Transitive Interactive logon of (null)\`bjeiVlak[]Y_bUUbY from workstationname1 (via workstationname1) Entered
10/02 15:26:19 [LOGON] ADMIN: NlPickDomainWithAccount: `bjeiVlak[]Y_bUUbY: Algorithm entered. UPN:0 Sam:0 Exp:0 Cross: 0 Root:1 DC:0
10/02 15:26:19 [LOGON] ADMIN: SamLogon: Transitive Interactive logon of (null)\`bjeiVlak[]Y_bUUbY from workstationname1 (via workstationname1) Returns 0xC0000064
10/02 15:26:20 [LOGON] ADMIN: SamLogon: Transitive Interactive logon of (null)\`bjeiVlak[]Y_bUUbY from workstationname3 (via workstationname3) Entered
10/02 15:26:20 [LOGON] ADMIN: NlPickDomainWithAccount: `bjeiVlak[]Y_bUUbY: Algorithm entered. UPN:0 Sam:0 Exp:0 Cross: 0 Root:1 DC:0
10/02 15:26:20 [LOGON] ADMIN: SamLogon: Transitive Interactive logon of (null)\`bjeiVlak[]Y_bUUbY from workstationname3 (via workstationname3) Returns 0xC0000064
These logs don't really help me much as i'd ideally have expected to see what machine the request came from.
When we clean the xCmdSvc from the system32 directory, another pc gets a copy of the same file in it's system32 directory to replace it. Netstat shows internal port 445 being used and the PC shows a connection to it's ipc$ share, but no clue as to where it came from.
We've got Sophos set to scan on read/write/access etc.. and on it's most through settings, so this has stopped the xCmdSvc.exe being wrote to most of the machines, although I can still see the attempts there.
Any ideas how we can track down the source of this and stop it running?
Cheers
