Discussion:
Domain admin account locked upon reboot
(too old to reply)
Rick
2007-01-27 00:01:02 UTC
Permalink
Sorry, I originally posted this in the wrong group...

Hi all, my admin account keeps getting locked out every time I reboot one of
my servers (recently changed my password). I have no manually mapped drives,
no cached login infor in keymgr.cpl and non of the services are configured to
use my admin account. I also checked all object in DCOM and non use my
account.

Here's the alockout log:

Thu Jan 25 12:36:55 2007, PID: 716, Thread: 720, Image
winlogon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:56 2007, PID: 768, Thread: 772, Image
C:\WINDOWS\system32\services.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:56 2007, PID: 780, Thread: 784, Image
C:\WINDOWS\system32\lsass.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1020, Thread: 1028, Image
C:\WINDOWS\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1072, Thread: 1080, Image
C:\WINDOWS\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1152, Thread: 1160, Image
C:\WINDOWS\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1168, Thread: 1172, Image
C:\WINDOWS\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1228, Thread: 1232, Image
C:\WINDOWS\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:36:58 2007, PID: 1304, Thread: 1308, Image C:\Program
Files\Common Files\Symantec Shared\ccSetMgr.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:36:59 2007, PID: 1364, Thread: 1368, Image C:\Program
Files\Common Files\Symantec Shared\ccEvtMgr.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:05 2007, PID: 1704, Thread: 1708, Image
C:\WINDOWS\system32\spoolsv.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:05 2007, PID: 1732, Thread: 1736, Image
C:\WINDOWS\system32\msdtc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:07 2007, PID: 1924, Thread: 1928, Image C:\Program
Files\compaq\cpqacuxe\Bin\hpacubin.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:07 2007, PID: 1984, Thread: 1988, Image
C:\hp\hpsmh\data\cgi-bin\vcrepository\cpqsrhmo.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 2000, Thread: 2004, Image
C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 2036, Thread: 2040, Image D:\program
files\sav\Symantec AntiVirus\Symantec AntiVirus\DefWatch.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 308, Thread: 296, Image
C:\WINDOWS\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 336, Thread: 340, Image
C:\WINDOWS\system32\grovel.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 436, Thread: 440, Image C:\Program
Files\HP\Performance Management Pack 4\pmp.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:08 2007, PID: 460, Thread: 464, Image C:\Program
Files\HP\Performance Management Pack 4\PMPTools\pmptools.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 512, Thread: 412, Image
C:\PROGRA~1\HP\SYSTEM~2\lbin\hpsimsvc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 556, Thread: 560, Image C:\Program
Files\HP\Systems Insight Manager\lbin\mxdtf,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 564, Thread: 592, Image C:\Program
Files\HP\HP Virtualization Management Software\bin\hpvmmsvc.exe,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 648, Thread: 652, Image
C:\WINDOWS\system32\inetsrv\inetinfo.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 676, Thread: 680, Image
C:\WINDOWS\system32\cba\pds.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 932, Thread: 784, Image C:\Program
Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:09 2007, PID: 1284, Thread: 1256, Image C:\Program
Files\Microsoft SQL Server\MSSQL$BKUPEXEC\Binn\sqlservr.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:10 2007, PID: 1592, Thread: 1596, Image C:\Program
Files\Microsoft SQL Server\MSSQL$WSUS\Binn\sqlservr.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:10 2007, PID: 1600, Thread: 924, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:10 2007, PID: 1696, Thread: 1700, Image
..\jrewindows\bin\hpvmmsvcj.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:11 2007, PID: 2088, Thread: 2092, Image C:\Program
Files\HP\Systems Insight Manager\lbin\mxdomainmgr,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:13 2007, PID: 2248, Thread: 2252, Image
D:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:13 2007, PID: 2340, Thread: 2344, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:14 2007, PID: 2340, Thread: 2344, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:37:17 2007, PID: 2548, Thread: 2556, Image
d:\Repository\psp-7.51.w2k3.i386.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:17 2007, PID: 2660, Thread: 2664, Image
C:\PROGRA~1\POWERC~1\pcns.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:24 2007, PID: 2872, Thread: 2876, Image ,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:24 2007, PID: 2960, Thread: 2964, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:25 2007, PID: 3048, Thread: 3052, Image
c:\inetpub\wwwroot\SMSComponent\SMSRPH.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:25 2007, PID: 3100, Thread: 3108, Image
C:\WINDOWS\System32\snmp.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:26 2007, PID: 3152, Thread: 3156, Image D:\program
files\sav\Symantec AntiVirus\Symantec AntiVirus\Rtvscan.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:26 2007, PID: 2912, Thread: 2988, Image
C:\WINDOWS\system32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:27 2007, PID: 3256, Thread: 3260, Image
C:\hp\hpsmh\bin\smhstart.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:27 2007, PID: 2960, Thread: 3036, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:37:27 2007, PID: 3332, Thread: 3340, Image
C:\WINDOWS\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:28 2007, PID: 3344, Thread: 3352, Image
C:\WINDOWS\system32\tftpd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:28 2007, PID: 3392, Thread: 3400, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:28 2007, PID: 3384, Thread: 3388, Image C:\Program
Files\The Open Group\WMI Mapper\bin\WbemCons.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:28 2007, PID: 3584, Thread: 3588, Image C:\Program
Files\RealVNC\VNC4\WinVNC4.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:28 2007, PID: 3624, Thread: 3628, Image C:\Program
Files\The Open Group\WMI Mapper\bin\WMIServer.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:29 2007, PID: 3664, Thread: 3668, Image c:\program
files\update services\service\bin\wsusservice.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:29 2007, PID: 3704, Thread: 3708, Image
MsgSys.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:30 2007, PID: 3828, Thread: 3832, Image
D:\SMS_CCM\CLICOMP\RemCtrl\Wuser32.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:30 2007, PID: 3876, Thread: 3880, Image C:\Program
Files\VERITAS\Backup Exec\NT\beremote.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:31 2007, PID: 3928, Thread: 3932, Image C:\Program
Files\VERITAS\Backup Exec\NT\benetns.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:31 2007, PID: 3940, Thread: 3944, Image
C:\hp\hpsmh\bin\hpsmhd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:31 2007, PID: 3972, Thread: 3976, Image C:\Program
Files\VERITAS\Backup Exec\NT\pvlsvr.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:31 2007, PID: 4008, Thread: 4012, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:31 2007, PID: 4016, Thread: 4020, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:32 2007, PID: 3392, Thread: 3540, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:37:32 2007, PID: 4048, Thread: 4056, Image
C:\WINDOWS\system32\tcpsvcs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:32 2007, PID: 660, Thread: 964, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:32 2007, PID: 1000, Thread: 1328, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:33 2007, PID: 4092, Thread: 300, Image
D:\SMS_CCM\CcmExec.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:33 2007, PID: 1760, Thread: 1756, Image
C:\hp\hpsmh\bin\hpsmhd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:34 2007, PID: 1588, Thread: 2240, Image
C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:34 2007, PID: 2352, Thread: 2356, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:34 2007, PID: 2244, Thread: 2232, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:34 2007, PID: 2464, Thread: 2340, Image
C:\WINDOWS\system32\CPQMgmt\CqMgServ\cqmgserv.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:35 2007, PID: 2628, Thread: 2236, Image
C:\WINDOWS\system32\CPQMgmt\CqMgStor\cqmgstor.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:35 2007, PID: 2692, Thread: 2696, Image
C:\hp\hpsmh\bin\rotatelogs.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:35 2007, PID: 2712, Thread: 2720, Image
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:36 2007, PID: 4632, Thread: 4636, Image
C:\WINDOWS\system32\ams_ii\iao.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:37 2007, PID: 4684, Thread: 4688, Image
C:\WINDOWS\system32\cba\xfr.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:39 2007, PID: 4832, Thread: 4836, Image
C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:41 2007, PID: 4740, Thread: 4744, Image
D:\SMS\bin\i386\smsexec.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:42 2007, PID: 5144, Thread: 5148, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:42 2007, PID: 5152, Thread: 5156, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:42 2007, PID: 5172, Thread: 5176, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:42 2007, PID: 5172, Thread: 5176, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:42 2007, PID: 5152, Thread: 5156, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:42 2007, PID: 5232, Thread: 5236, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:42 2007, PID: 5248, Thread: 5252, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:43 2007, PID: 5264, Thread: 5268, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:44 2007, PID: 5336, Thread: 5340, Image
D:\SMS\bin\i386\sitecomp.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:45 2007, PID: 5368, Thread: 5372, Image
C:\WINDOWS\system32\sysdown.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:45 2007, PID: 5144, Thread: 5196, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:37:45 2007, PID: 5392, Thread: 5396, Image
C:\WINDOWS\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:45 2007, PID: 5264, Thread: 5288, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:45 2007, PID: 5400, Thread: 5404, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:45 2007, PID: 5248, Thread: 5252, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:37:46 2007, PID: 5232, Thread: 5236, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:46 2007, PID: 5464, Thread: 5468, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:46 2007, PID: 5536, Thread: 5540, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:46 2007, PID: 5592, Thread: 5596, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:47 2007, PID: 2548, Thread: 2556, Image
d:\Repository\psp-7.51.w2k3.i386.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:52 2007, PID: 5592, Thread: 5636, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:52 2007, PID: 5400, Thread: 5504, Image C:\Program
Files\HP\Systems Insight Manager\bin\mxpassword,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:37:52 2007, PID: 5536, Thread: 5540, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:37:53 2007, PID: 5464, Thread: 5468, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:53 2007, PID: 5516, Thread: 5520, Image C:\Program
Files\VERITAS\Backup Exec\NT\beserver.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:54 2007, PID: 5896, Thread: 5900, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:54 2007, PID: 5912, Thread: 5916, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:54 2007, PID: 5912, Thread: 5916, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:54 2007, PID: 5896, Thread: 5900, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:54 2007, PID: 5928, Thread: 5932, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:54 2007, PID: 5936, Thread: 5940, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:54 2007, PID: 5944, Thread: 5948, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:56 2007, PID: 6084, Thread: 6088, Image
c:\windows\system32\inetsrv\w3wp.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:56 2007, PID: 6016, Thread: 6116, Image
C:\WINDOWS\system32\CPQMgmt\CqMgHost\cqmghost.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:37:57 2007, PID: 5944, Thread: 6000, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:57 2007, PID: 5936, Thread: 5940, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:37:58 2007, PID: 5928, Thread: 5932, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:37:58 2007, PID: 540, Thread: 3160, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:37:58 2007, PID: 4660, Thread: 4696, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:37:58 2007, PID: 4708, Thread: 4712, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:01 2007, PID: 4708, Thread: 4784, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:01 2007, PID: 4660, Thread: 4696, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:02 2007, PID: 5380, Thread: 5228, Image
C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:02 2007, PID: 540, Thread: 3160, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:03 2007, PID: 5424, Thread: 5428, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:03 2007, PID: 5236, Thread: 5232, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:03 2007, PID: 5236, Thread: 5232, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:03 2007, PID: 5424, Thread: 5428, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:03 2007, PID: 2552, Thread: 2560, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:03 2007, PID: 5252, Thread: 5248, Image C:\Program
Files\VERITAS\Backup Exec\NT\bengine.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:03 2007, PID: 5580, Thread: 5584, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:03 2007, PID: 5588, Thread: 5604, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:04 2007, PID: 4740, Thread: 5568, Image
D:\SMS\bin\i386\smsexec.exe,***WNetUseConnectionW Failed!*** (1), Local:
(null), Remote: \\KIL-ITADMIN\A$, Password: Password was NULL, Window Title:
, RC was: The network name cannot be found. (67), GLE was: The network name
cannot be found. (67)
Thu Jan 25 12:38:05 2007, PID: 4740, Thread: 5568, Image
D:\SMS\bin\i386\smsexec.exe,***WNetUseConnectionW Failed!*** (2), Local:
(null), Remote: \\KIL-ITADMIN\E$, Password: Password was NULL, Window Title:
, RC was: The device is not ready. (21), GLE was: The device is not ready.
(21)
Thu Jan 25 12:38:05 2007, PID: 5648, Thread: 5644, Image
C:\WINDOWS\System32\svchost.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:05 2007, PID: 716, Thread: 856, Image
winlogon.exe,***StartServiceW Failed!*** (0), Service: Failed to get Service
name, RC was: Incorrect function. (1), GLE was: The operation completed
successfully. (0)
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1108, Image
C:\WINDOWS\system32\svchost.exe,
***********************************************************
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1164, Image
C:\WINDOWS\system32\svchost.exe,
***********************************************************
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1052, Image
C:\WINDOWS\system32\svchost.exe,
***********************************************************
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1108, Image
C:\WINDOWS\system32\svchost.exe, * Service Failure - See System Log for
Details (ID: 7000) *
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1164, Image
C:\WINDOWS\system32\svchost.exe, * Service Failure - See System Log for
Details (ID: 7000) *
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1108, Image
C:\WINDOWS\system32\svchost.exe,
***********************************************************
Thu Jan 25 12:38:05 2007, PID: 1020, Thread: 1052, Image
C:\WINDOWS\system32\svchost.exe, * Service Failure - See System Log for
Details (ID: 7000) *
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 1164, Image
C:\WINDOWS\system32\svchost.exe,
***********************************************************
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 1052, Image
C:\WINDOWS\system32\svchost.exe,***********************************************************
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 3576, Image
C:\WINDOWS\system32\svchost.exe,***********************************************************
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 3576, Image
C:\WINDOWS\system32\svchost.exe,* Service Failure - See System Log for
Details (ID: 7000) *
Thu Jan 25 12:38:06 2007, PID: 5588, Thread: 5660, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 1108, Image
C:\WINDOWS\system32\svchost.exe,***StartServiceW Failed!*** (0), Service:
Service: Windows Management Instrumentation (C:\WINDOWS\system32\svchost.exe
-k netsvcs), RC was: The operation completed successfully. (0), GLE was: An
instance of the service is already running. (1056)
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 1164, Image
C:\WINDOWS\system32\svchost.exe,***StartServiceW Failed!*** (0), Service:
Service: Background Intelligent Transfer Service
(C:\WINDOWS\system32\svchost.exe -k netsvcs), RC was: Incorrect function.
(1), GLE was: The operation completed successfully. (0)
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 3576, Image
C:\WINDOWS\system32\svchost.exe,***********************************************************
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 1052, Image
C:\WINDOWS\system32\svchost.exe,***StartServiceW Failed!*** (0), Service:
Service: System Event Notification (C:\WINDOWS\system32\svchost.exe -k
netsvcs), RC was: The operation completed successfully. (0), GLE was: An
instance of the service is already running. (1056)
Thu Jan 25 12:38:06 2007, PID: 6096, Thread: 6124, Image
userinit.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:06 2007, PID: 5580, Thread: 5584, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:06 2007, PID: 1020, Thread: 3576, Image
C:\WINDOWS\system32\svchost.exe,***StartServiceW Failed!*** (0), Service:
Service: Windows Installer (C:\WINDOWS\system32\msiexec.exe /V), RC was:
Incorrect function. (1), GLE was: The operation completed successfully.
(0)
Thu Jan 25 12:38:06 2007, PID: 2552, Thread: 2560, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:07 2007, PID: 2212, Thread: 2444, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:07 2007, PID: 6056, Thread: 6052, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:07 2007, PID: 5992, Thread: 5988, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:07 2007, PID: 2228, Thread: 5132, Image
C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:08 2007, PID: 4712, Thread: 4784, Image
c:\windows\system32\inetsrv\w3wp.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:10 2007, PID: 5724, Thread: 5720, Image
d:\Repository\psp-7.60.w2k3.i386.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:11 2007, PID: 5992, Thread: 5028, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:11 2007, PID: 6068, Thread: 6132, Image
c:\windows\microsoft.net\framework\v1.1.4322\csc.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:38:11 2007, PID: 6056, Thread: 6052, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:11 2007, PID: 2784, Thread: 6136, Image
c:\windows\microsoft.net\framework\v1.1.4322\csc.exe,ALOCKOUT.DLL -
DLL_PROCESS_ATTACH
Thu Jan 25 12:38:11 2007, PID: 2212, Thread: 2444, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:11 2007, PID: 2228, Thread: 5132, Image
C:\WINDOWS\System32\WScript.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:11 2007, PID: 6096, Thread: 6124, Image
userinit.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:11 2007, PID: 4788, Thread: 4796, Image
userinit.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:12 2007, PID: 6156, Thread: 6160, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:12 2007, PID: 4788, Thread: 4796, Image
userinit.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:12 2007, PID: 6180, Thread: 6184, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:12 2007, PID: 6068, Thread: 6132, Image
c:\windows\microsoft.net\framework\v1.1.4322\csc.exe,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:38:12 2007, PID: 6180, Thread: 6184, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:12 2007, PID: 6156, Thread: 6160, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:12 2007, PID: 6204, Thread: 6208, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:12 2007, PID: 6212, Thread: 6216, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:12 2007, PID: 6236, Thread: 6240, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:14 2007, PID: 2784, Thread: 6136, Image
c:\windows\microsoft.net\framework\v1.1.4322\csc.exe,ALOCKOUT.DLL -
dll_process_detatch
Thu Jan 25 12:38:16 2007, PID: 6236, Thread: 6268, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:16 2007, PID: 6212, Thread: 6216, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:16 2007, PID: 6204, Thread: 6208, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:16 2007, PID: 6400, Thread: 6404, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:16 2007, PID: 6408, Thread: 6412, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:16 2007, PID: 6424, Thread: 6428, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:17 2007, PID: 6452, Thread: 6456, Image
C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:19 2007, PID: 6424, Thread: 6448, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:19 2007, PID: 6408, Thread: 6412, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:19 2007, PID: 6400, Thread: 6404, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:20 2007, PID: 6604, Thread: 6608, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:20 2007, PID: 6612, Thread: 6616, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:21 2007, PID: 6612, Thread: 6616, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:21 2007, PID: 6604, Thread: 6608, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:21 2007, PID: 6640, Thread: 6644, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:21 2007, PID: 6648, Thread: 6652, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:21 2007, PID: 6676, Thread: 6680, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:22 2007, PID: 6728, Thread: 6732, Image
C:\WINDOWS\system32\wbem\wmiprvse.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:25 2007, PID: 6676, Thread: 6716, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:25 2007, PID: 6648, Thread: 6652, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:25 2007, PID: 6640, Thread: 6644, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:25 2007, PID: 6904, Thread: 6908, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:26 2007, PID: 6920, Thread: 6924, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:27 2007, PID: 7048, Thread: 7052, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:28 2007, PID: 7192, Thread: 7196, Image
winlogon.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:29 2007, PID: 7268, Thread: 7272, Image
C:\WINDOWS\system32\WBEM\MOFCOMP,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:29 2007, PID: 7268, Thread: 7272, Image
C:\WINDOWS\system32\WBEM\MOFCOMP,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:32 2007, PID: 7048, Thread: 7248, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:32 2007, PID: 6920, Thread: 6924, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:32 2007, PID: 6904, Thread: 6908, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:33 2007, PID: 7580, Thread: 7584, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:33 2007, PID: 7612, Thread: 7616, Image
hostname,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:34 2007, PID: 7612, Thread: 7616, Image
hostname,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:34 2007, PID: 7580, Thread: 7584, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:34 2007, PID: 7632, Thread: 7636, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:34 2007, PID: 7640, Thread: 7644, Image cmd,ALOCKOUT.DLL
- DLL_PROCESS_ATTACH
Thu Jan 25 12:38:34 2007, PID: 7648, Thread: 7652, Image
mxpassword,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Thu Jan 25 12:38:36 2007, PID: 7648, Thread: 7672, Image
mxpassword,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:36 2007, PID: 7640, Thread: 7644, Image cmd,ALOCKOUT.DLL
- dll_process_detatch
Thu Jan 25 12:38:36 2007, PID: 7632, Thread: 7636, Image
C:\WINDOWS\system32\cmd.exe,ALOCKOUT.DLL - dll_process_detatch
Thu Jan 25 12:38:36 2007, PID: 7756, Thread: 7760, Image

I also noticed the following security event right before my account gets
locked (not sure if it's related):

Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,58034}
Process ID: 768
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MYSERVER$
Primary Domain: MYDOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
Connect to service controller
Lock service database for exclusive access

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20009
Pegasus (MVP)
2007-01-27 00:07:08 UTC
Permalink
Post by Rick
Sorry, I originally posted this in the wrong group...
Hi all, my admin account keeps getting locked out every time I reboot one of
my servers (recently changed my password). I have no manually mapped drives,
no cached login infor in keymgr.cpl and non of the services are configured to
use my admin account. I also checked all object in DCOM and non use my
account.
Since you recently changed your password, your problem is
obviously caused by some process that still uses the old password.
I suspect a scheduled task.

It is better to create a dedicated account for scheduled tasks and
for services instead of using your own account, for reasons that
are now becoming clear.
Rick
2007-01-27 01:56:00 UTC
Permalink
Hi, thanks for you reply. No scheduled tasks are running under my admin
account, we do have service accounts for these.

Rick
Post by Pegasus (MVP)
Since you recently changed your password, your problem is
obviously caused by some process that still uses the old password.
I suspect a scheduled task.
It is better to create a dedicated account for scheduled tasks and
for services instead of using your own account, for reasons that
are now becoming clear.
Will
2007-01-27 02:03:30 UTC
Permalink
This is a member server, and you are attempting login with the local builtin
Administrator account?

Can you disconnect this computer from the network during the next reboot and
see if the account resets? You should at least positively rule out the
possibility that the lockout is due to some interaction with the network,
then that will focus next efforts.
--
Will
Post by Rick
Hi, thanks for you reply. No scheduled tasks are running under my admin
account, we do have service accounts for these.
Rick
Post by Pegasus (MVP)
Since you recently changed your password, your problem is
obviously caused by some process that still uses the old password.
I suspect a scheduled task.
It is better to create a dedicated account for scheduled tasks and
for services instead of using your own account, for reasons that
are now becoming clear.
Rick
2007-01-29 17:27:05 UTC
Permalink
Hi Will, this is a member server and the account is a Domain Admin account,
not local. If I pull the network cable and reboot, it does not lock my
account.
Post by Will
This is a member server, and you are attempting login with the local builtin
Administrator account?
Can you disconnect this computer from the network during the next reboot and
see if the account resets? You should at least positively rule out the
possibility that the lockout is due to some interaction with the network,
then that will focus next efforts.
--
Will
Will
2007-01-30 02:31:15 UTC
Permalink
Post by Rick
Hi Will, this is a member server and the account is a Domain Admin account,
not local. If I pull the network cable and reboot, it does not lock my
account.
So what seems likely is that *something* on this member server is attempting
a connection to your domain controller with the wrong credentials.

On the domain controller, are you auditing failed logins? If not, start
doing so. Are you seeing failed login attempts from this member server
prior to your attempted logins in the security event viewer of the domain
controller? They must be there, because the account does not get locked
out unless you reboot this particular server.

Now the question is where is the program that is entering the bad command
located. Is it possible you have a startup script running on that server
that possibly attempts to copy over files from the server after
authenticating from a command line script with NET USE? Perhaps that
script has hard-coded into it the old password? Have you thought about
scanning all local hard drives for any file that contains the old domain
controller password?

Is there any chance you are logging in as the local administrator and then
attempting to use NET USE with domain administrator credentials?
--
Will
Rick
2007-01-30 18:33:01 UTC
Permalink
Post by Will
So what seems likely is that *something* on this member server is attempting
a connection to your domain controller with the wrong credentials.
Totally agree.
Post by Will
On the domain controller, are you auditing failed logins? If not, start
doing so. Are you seeing failed login attempts from this member server
prior to your attempted logins in the security event viewer of the domain
controller? They must be there, because the account does not get locked
out unless you reboot this particular server.
Yes, and I can see failed login attempts from the member server in question
when I reboot it.
Post by Will
Now the question is where is the program that is entering the bad command
located. Is it possible you have a startup script running on that server
that possibly attempts to copy over files from the server after
authenticating from a command line script with NET USE? Perhaps that
script has hard-coded into it the old password? Have you thought about
scanning all local hard drives for any file that contains the old domain
controller password?
No startup scripts that are unique to this server. I did upgrade HP's
Insight Manager lately and this could be the cause but I'm not 100% certain.

I scanned all files on the server and the registry for the name of my admin
ID since I would think a password stored in a configuration file or registry
would be encrypted and not stored in plain text. Didn't find anything. I
will scan all files for my old password in a little while.
Post by Will
Is there any chance you are logging in as the local administrator and then
attempting to use NET USE with domain administrator credentials?
Nope, I never log in as the local administrator, only a domain admin account.
Post by Will
--
Will
Is there anything from the alockout.log that I posted that helps to identify
what might be causing this?

Rick
Will
2007-01-31 00:09:12 UTC
Permalink
Microsoft has a program named MSConfig that will freeze execution of some of
the startup tasks when you login until you give explicit permission for each
to continue. I would selectively start to deselect items from that and
rebooting and keep careful track of the point at which the authentication no
longer takes place.

I would also search your sysvol on the domain controller for any scripts in
any group policy, and you may find one somewhere you didn't know about. I
don't know from memory how to check for a startup script on a computer, but
no doubt there is a registry setting for that and you should look for it.

If you have excluded any startup script, and excluded any scheduled task,
and excluded and startup task that MSConfig can trace, you may have a virus
at work. If the abnormal behavior you see suddenly stops out of the blue
in the next few days I would get particularly concerned since the trojan
could have brute force attacked any locally cached hashes of your new domain
password and broken them, hence no more account lockouts. If I couldn't
account for why this behavior was happening I would want to disconnect this
machine from my network entirely until I had an explanation.

Finally, have you thought about running a sniffer on the computer after it
boots up and check for what ports the machine is trying to reach on your
network. I would be suspect of all SMB activity (destination ports 139 and
445) to machines that are not file servers or domain controllers. With the
computer off the network I would leave a sniffer running for a few days and
sift through the traffic filtering out what is expected and analyzing
carefully what is not.
--
Will
Rick
2007-02-01 01:32:01 UTC
Permalink
Will, thanks for your help. I found out it was the HP Virtual Machine
Manager service (even though the service used a service account to run). I
don't use this software so I uninstalled it - problem solved.

Rick
Will
2007-02-01 03:09:18 UTC
Permalink
Post by Rick
Will, thanks for your help. I found out it was the HP Virtual Machine
Manager service (even though the service used a service account to run).
I
Post by Rick
don't use this software so I uninstalled it - problem solved.
Another quality HP software product. :) I still wish for the old Compaq
driver update software they wrote for their workstation product line. HP
software steadily gets worse each new generation. Anyway, glad you found
it.
--
Will
Loading...