[dreamofthephoenix]

This is probably a stupid question (and I have a lot more where this came from ):
I was looking at entries under Security in Event Viewer and noticed several entries with 'Anonoymous Logon' listed under User. Is this anything to be worried about or am I just being paranoid?
Don't know if this is important information or not but I'm the only one who uses this computer, guest account is turned off. I use the Firefox browser and am running Norton Anti-Virus, ZoneAlarm, Spyware Blaster, SpyBot, and AdAware (all of which I regularly update).

[Advertisements]

depends...are you on a network?

Could you cut and paste an anonymous logon message (click the little copy button after double clicking the event)

[gerryf]

depends...are you on a network?

Could you cut and paste an anonymous logon message (click the little copy button after double clicking the event)

[dreamofthephoenix]

No, I'm not on a network.

This is one of the messages:

Event
Date: 2/11/2006 Source: Security
Time: 8:16:25 AM Category: Logon/Logoff
Type: Success Event ID: 540
User: NT AUTHORITY/ANONYMOUS LOGON
Computer:

Description:
Sucessful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xD 252)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

Edited by dreamofthephoenix, 11 February 2006 - 11:23 AM.

[gerryf]

Unless you have a reason for concern, I would not be. You said you are not on a network, but you are using broadband cable--which is essentially a network (in fact, you're right around the corner from me, well from an Internet perspective since it looks like you're in Oakland County, MI--what a small world

Some network applications use the ANONYMOUS LOGON process to create a communication
channel with your computer. Anonymous logon means that it is a null session. NT Auth/Anonymous is just
a pseudonym for a Null Session. The NTAuth/Anonymous isn't really an account; it just means that no credentials were supplied. There are many conditions known to cause a null session connection which makes it difficult to tell the exact cause of these particular events.

Your log on was caused by the service NTLMSSP, which is NT Lan Manager Secure Service Provider.

Have you noticed specific times when this occurs? Perhaps when you start your computer? They do not occur all the time thoughout the day, do they.

Who installed your system? You? or Comcast? Did you install their computer helpdesk software? That is one thing that will do it.....

[dreamofthephoenix]

I'm totally freaked now.....from that little bit of information I posted you knew that I have cable internet and what part of the country I'm in. You have GOT to teach me how you did that!!!!!
Anyway, I checked the Event Viewer and the Anonymous Logon doesn't happen often. I checked the times they do occur and it appears they occur around the times I logon to the computer.
Comcast installed my internet service for me and as far as I know I don't have the Comcast Helpdesk software installed (but I never looked for it so who knows?).

[gerryf]

I have you at a disadvantage because I can see your IP address (which is logged bny the forum software.

Reading an IP address is fairly simple once you get in the habit. We share the same network (the first part of the IP address), so I know you're a comcast customer. You're on a different subnet than I though, so you are not in the same town as I am. This network ID for comcast is still a pretty big number and wouldn't matter much in terms of knowing where you are, but a simple tracert will reveal more info.

start > run
cmd
<enter>

for example

type
tracert 64.233.167.104
<enter>

this will reveal the path from your computer to www.google.com. When you request a webpage or attach to another computer, the information needs to travel across multiple routers. Some of this will be obvious...you will see things like Flint, Pontiac, Chicago...some of the information takes a little more work.

In your case, a trace from me to you was three or four hops, so you were close, plus it was all on the comcast network, which uses obviously named routers so I could see you were in the same general area....even a pretty good guess of what city you live in, but Oakland County was enough info for a public board

Some of the information is obvious

[dreamofthephoenix]

Ahhhhhhh, the IP address...I didn't think about that. Thanks for the info (and for not posting the city I'm in )