Have I been hacked??

[kimble]

Something odd happened this morning when I logged into my server as admin. W2K Server SP2

1. An default icon was on the taskbar with its target pointing to outlook....yet outlook is not on this machine.
2. On the start menu -> programs -> there is a folder called 'passware'. I don't know where this came from.

I've looked at my logs and I don't see a record of anyone logging in...Yet I'm only looking at what gets posted to Event Viewer.

In AD under Foreign Security Pricipals there are two objects that I don't recall being there. They are labeled:
S-1-5-11
S-1-5-4
Both were created back on 9/24/01. I don't know what they are.

Can anyone help me with tracking down what went on here?
Thanks

 

[MasterRacker]

Looks like a hack to me. Unfortunately we're beyond my areas of expertise to track it down. Check in MMC for any strange looking active programs or services.
Jeff
I haven't lost my mind - I know it's backed up on tape somewhere ....

 

[kimble]

I actually noticed that I lost my mind for a second. I had setup a profile for administrator account when i was adding profiles for other accounts and then after logging onto other machines and back to mine it saved some of the settings from the other clients. whoops.

 

[MasterRacker]

That's certainly another way stuff can 'appear'.
Jeff
I haven't lost my mind - I know it's backed up on tape somewhere ....