asked on

how to tell if someone has hacked into your system

i have a computer with several pings to daily from all over the world.
how can i tell if they have got into the system?

thanks

webdott

ASKER

this is one of the pings:
Event Type: Information
Event Source: WinVNC4
Event Category: None
Event ID: 1
Date: 1/4/2010
Time: 5:10:52 PM
User: N/A
Computer: MAIN
Description:
The description for Event ID ( 1 ) in Source ( WinVNC4 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Connections, accepted: 200.175.180.64::xxxx.
it says the connection was accepted?
does this mean they got it?

chuku

This error mean nothing
there are many scans out there but it doesn't mean they got in
do you have a firewall or any other security deices and logs?

ASKER CERTIFIED SOLUTION

snusgubben

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

hmtwins

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

snusgubben

Just another thought.

Is you computer behind a firewall in a LAN?

Are we talking about a Windows domain?

Leaving VNC open towards the Internet is risky business. There is a VNC v.4.1.1 cracker tool that allowed users to bypass the VNC authentication. So be sure to check your VNC version.

webdott

ASKER

yes it is VNC v4.1.1 free edition.
It is behind a sonicwall firewall. no anti-virus or other on this server
operating system: windows server 2003 r2
i have uninstalled the VNC. the errors have haved stopped in eventvwr

webdott

ASKER

thanks