Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Event ID 4740 all my domain accounts where locked out with the same caller Computer Name, what does this mean? am i getting attacked?!

Posted on 2011-02-18
6
Medium Priority
?
3,463 Views
Last Modified: 2012-05-11
Hi all,

every single account on my domain was just locked out with event ID 4740 and the caller computer name came from a machine in another office for all events

what is the caller computer name? the computer that made the lockout happen?

are we being attacked internally?

Thansk for a speedy response
0
Comment
Question by:awilderbeast
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 2

Expert Comment

by:FellFreeDom
ID: 34925343
I think that you've got a Kido virus.
please check for windows update and try to use kido killer tool
http://support.kaspersky.com/kis2009/error?qid=208279973
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 34925366
sorry it did nearly all the domain accounts

that machine has got kaspersky for business on it all our machines do :S


the caller computer name, does that mean thats the machine that caused the lockout of the accounts?
0
 
LVL 2

Expert Comment

by:FellFreeDom
ID: 34925425
does that mean thats the machine that caused the lockout of the accounts?
yep
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 
LVL 1

Author Comment

by:awilderbeast
ID: 34925472
ok run kk on that computer

came back with the below!

thats the only machine i didnt put kaspersky on it,

running kaspersky nearly killed the machines power its that old
will have to replace it or put it back on and the user will have to cope with a slow machine!

how does kido generally get on the machine?
USB, download?

Thanks for your help
Net-Worm.Win32.Kido removing tool, Kaspersky Lab 2010
version 3.4.14  Mar 19 2010 10:17:17
scanning        jobs ...

scanning        processes ...

scanning        threads ...
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068

scanning        modules in svchost.exe...
Spliced function NtQueryInformationProcess fixed in ntdll.dll module of process
with PID 1068
Spliced function NetpwPathCanonicalize fixed in netapi32.dll module of process w
ith PID 1068
Spliced function NtQueryInformationProcess fixed in ntdll.dll module of process
with PID 1216
Spliced function DnsQuery_A fixed in dnsapi.dll module of process with PID 1216
Spliced function DnsQuery_UTF8 fixed in dnsapi.dll module of process with PID 12
16
Spliced function DnsQuery_W fixed in dnsapi.dll module of process with PID 1216
Spliced function Query_Main fixed in dnsapi.dll module of process with PID 1216
scanning        modules in services.exe...
scanning        modules in explorer.exe...

scanning        C:\WINDOWS\system32 ...
C:\WINDOWS\system32\okfkhbhj.dll        infected Net-Worm.Win32.Kido ...
cured
scanning        C:\Program Files\Internet Explorer\ ...
scanning        C:\Program Files\Movie Maker\ ...
scanning        C:\Program Files\Windows Media Player\ ...
scanning        C:\Program Files\Windows NT\ ...
scanning        C:\Documents and Settings\AlexWilloughby.WORKS\Application Data
...
scanning        C:\DOCUME~1\ALEXWI~1.WOR\LOCALS~1\Temp\ ...
scanning        Flash drives ...

completed
Infected jobs:                  0
Infected files:                 1
Infected threads:               7
Spliced functions:              7
Cured files:                    1
Fixed registry keys:            3

Press any key to continue . . .

Open in new window

0
 
LVL 2

Accepted Solution

by:
FellFreeDom earned 2000 total points
ID: 34925692
how does kido generally get on the machine?
USB, download?
you have to know that no one AV is NOT 100% guarantee =)
so it's doesn't matter how kido gets you.
use Windows Update, always use it, and it will be more safe to you and your company =)
0
 
LVL 1

Author Closing Comment

by:awilderbeast
ID: 34925704
Thanks alot!
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question