Solved

Event ID 4740 all my domain accounts where locked out with the same caller Computer Name, what does this mean? am i getting attacked?!

Posted on 2011-02-18
6
3,424 Views
Last Modified: 2012-05-11
Hi all,

every single account on my domain was just locked out with event ID 4740 and the caller computer name came from a machine in another office for all events

what is the caller computer name? the computer that made the lockout happen?

are we being attacked internally?

Thansk for a speedy response
0
Comment
Question by:awilderbeast
  • 3
  • 3
6 Comments
 
LVL 2

Expert Comment

by:FellFreeDom
ID: 34925343
I think that you've got a Kido virus.
please check for windows update and try to use kido killer tool
http://support.kaspersky.com/kis2009/error?qid=208279973
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 34925366
sorry it did nearly all the domain accounts

that machine has got kaspersky for business on it all our machines do :S


the caller computer name, does that mean thats the machine that caused the lockout of the accounts?
0
 
LVL 2

Expert Comment

by:FellFreeDom
ID: 34925425
does that mean thats the machine that caused the lockout of the accounts?
yep
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 
LVL 1

Author Comment

by:awilderbeast
ID: 34925472
ok run kk on that computer

came back with the below!

thats the only machine i didnt put kaspersky on it,

running kaspersky nearly killed the machines power its that old
will have to replace it or put it back on and the user will have to cope with a slow machine!

how does kido generally get on the machine?
USB, download?

Thanks for your help
Net-Worm.Win32.Kido removing tool, Kaspersky Lab 2010
version 3.4.14  Mar 19 2010 10:17:17
scanning        jobs ...

scanning        processes ...

scanning        threads ...
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068
Infected thread was killed in process svchost.exe with PID 1068

scanning        modules in svchost.exe...
Spliced function NtQueryInformationProcess fixed in ntdll.dll module of process
with PID 1068
Spliced function NetpwPathCanonicalize fixed in netapi32.dll module of process w
ith PID 1068
Spliced function NtQueryInformationProcess fixed in ntdll.dll module of process
with PID 1216
Spliced function DnsQuery_A fixed in dnsapi.dll module of process with PID 1216
Spliced function DnsQuery_UTF8 fixed in dnsapi.dll module of process with PID 12
16
Spliced function DnsQuery_W fixed in dnsapi.dll module of process with PID 1216
Spliced function Query_Main fixed in dnsapi.dll module of process with PID 1216
scanning        modules in services.exe...
scanning        modules in explorer.exe...

scanning        C:\WINDOWS\system32 ...
C:\WINDOWS\system32\okfkhbhj.dll        infected Net-Worm.Win32.Kido ...
cured
scanning        C:\Program Files\Internet Explorer\ ...
scanning        C:\Program Files\Movie Maker\ ...
scanning        C:\Program Files\Windows Media Player\ ...
scanning        C:\Program Files\Windows NT\ ...
scanning        C:\Documents and Settings\AlexWilloughby.WORKS\Application Data
...
scanning        C:\DOCUME~1\ALEXWI~1.WOR\LOCALS~1\Temp\ ...
scanning        Flash drives ...

completed
Infected jobs:                  0
Infected files:                 1
Infected threads:               7
Spliced functions:              7
Cured files:                    1
Fixed registry keys:            3

Press any key to continue . . .

Open in new window

0
 
LVL 2

Accepted Solution

by:
FellFreeDom earned 500 total points
ID: 34925692
how does kido generally get on the machine?
USB, download?
you have to know that no one AV is NOT 100% guarantee =)
so it's doesn't matter how kido gets you.
use Windows Update, always use it, and it will be more safe to you and your company =)
0
 
LVL 1

Author Closing Comment

by:awilderbeast
ID: 34925704
Thanks alot!
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now