In order to fill a need for my company's users and clients, we had to throw together an XP pro box and set it up external to our network to use as an FTP server. Believe it or not, but it's actually worked very well. However, as of late, I think there is a script kiddie trying to hack the server. In my system log I get the following error
Kind of looks to me like someone is trying to log onto the desktop. These warnings are logged anywhere from 3 times a second to every 20 seconds and the attacks last about 45 minutes. It's been happening every other day for a few days now. I'm not much worried because the Administrator account is disabled, but I'd like to catch the little <insert word here used to describe a child that does not have a father>. Or at the very least, block whatever IP the attack is coming from. However, the only information that I'm getting is the warning message above. Anyone have suggestions as to additional logging I could turn on to try and get more information from whoever is attacking me?
Code:
Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 7/31/2008
Time: 6:36:56 AM
User: N/A
Computer: <system>
Description:
The server was unable to logon the Windows NT account 'Administrator' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at: [URL unfurl="true"]http://www.microsoft.com/contentredirect.asp.[/URL]
For more information, see Help and Support Center at [URL unfurl="true"]http://go.microsoft.com/fwlink/events.asp.[/URL]
Data:
0000: 2e 05 00 00 ....