The techie at Karoo made it perfectly clear by the information that i gave him that the console that hacked me was based in the Californian company that "monitors" trafic on their behalf therefore they are an agent of Karoo and thus i was hacked by Karoo.
I am not stupid enough to have remote access enabled.
When i asked who's jurisdiction they were working under IE British law?American law? they had no answer i suspect that their silence and the fact that they readily supplied me with the company name and address is an admission of guilt.
04/05/2007 16:12:40 Security Success Audit Logon/Logoff 540 NT AUTHORITY\ANONYMOUS LOGON YOUR-EVF1TFJ8B7 "Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x12ED5)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}"
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 10/05/2007
Time: 00:01:13
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: YOUR-EVF1TFJ8B7
Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x12B32)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}
Going through this message bit by bit then:
Logon Type 3 = This is a Windows network logon event. It's the type of thing that would be logged if someone was trying to connect to a shared folder on computer for instance.
Authentication Package: NTLM = This is the NT LAN Manager. It'd be the authentication method used to connect to your computer.
Logon Process: NtLmSsp = Again, part of the authentication process.
User: NT AUTHORITY\ANONYMOUS LOGON = Well, this is a built in user account. It has a few jobs, but amongst other things it's the account that's used when browsing a computer to find out what's on it.
Down to the bones of it then:
From the information that you have provided,
this looks to be an attempt by someone to establish whether or not you have any shared folders which they can access. I can't really say any more than that. I can't say who it was, or if they saw anything..... It isn't related to your cursor moving about as this would happen in the background without you being aware.
It isn't a description of an RDP (remote desktop connection) attempt, as again, you wouldn't see anything happen (you'd simply be logged off from your session.)
I've got to be honest though, you cannot remain safe and secure on the Internet, using Windows (any version) unless you happen to be extremely skilled at managing a Windows desktop (or if you don't use the Internet I guess!).
If security is very important to you, I personally would suggest that you
download and try Ubuntu. It's a drop in replacement for Windows which is built on Linux, and thus is very secure. It doesn't cost anything, and the sponsor of this forum 'lefty' does free tech support for it. (Oh, and I use it too!)
Cheers
Dylan
