Windows 10: Remote Login and New admin account created on my machine - hacked?

  1.    24 Nov 2016 #1

    Remote Login and New admin account created on my machine - hacked?


    OK so a user named Lorenco was logged into my machine today when I went to login.
    This user account should not exist and was connected remotely I believe
    I captured all the event logs, what do I need to verify this was a hack or a legit login?
    Received user logon notification on session 4.
    shell\roaming\settingsync\settingprofilehandler.cpp(24)\SettingSync errors
    event log cleared the user
    The audit log was cleared.
    Subject:
    Security ID: GROD\Lorenco
    Account Name: Lorenco
    Domain Name: GROD
    Logon ID: 0x46D9E82

    A user's local group membership was enumerated.

    Subject:
    Security ID: GROD\Lorenco
    Account Name: Lorenco
    Account Domain: GROD
    Logon ID: 0x46D9EA0

    User:
    Security ID: GROD\Lorenco
    Account Name: Lorenco
    Account Domain: GROD

    Process Information:
    Process ID: 0x2618
    Process Name: C:\Users\Lorenco\Desktop\GoogleChromePortable\App\Chrome-bin\chrome.exe

    Much more in the logs..
      My ComputerSystem Spec

  2.    24 Nov 2016 #2

    WinLogonView shows me they are from EU.

    How they got in is beyond me, I am a network engineer not a dummy about security..

    Click image for larger version. 

Name:	2016_11_25_03_01_091.png 
Views:	11 
Size:	10.1 KB 
ID:	111323
      My ComputerSystem Spec


 

Related Threads
Repeatedly having my Windows 10 Account Passwords Hacked. in AntiVirus, Firewalls and System Security
Wondering if anyone here knows high-security ways to secure the Windows SAM (Security Accounts Manager) file from being hacked via remote network access or physical access to an unattended machine. Have already informed the police (though they...
Hello All, I'm delighted to have found you and after a long day of trying to help myself i am now requiring your much appreciated assistance please!:cry: I'm not a techy person at all and am hoping someone can help:) Last week my husband purchased...
ASP.NET Machine account is my Admin now in User Accounts and Family Safety
So I made a lot of mess on my new Windows 10.I wanted to play FarmVille 2.Because its free on Windows 10.Microsoft wanted from me to make an account.I did it.And then when I turn off my PC .It wanted for me password from my account to log in to my...
Domain admin account as built-in admin account in User Accounts and Family Safety
I just upgraded two brand new pc's from Win 7 to Win 10. Computers were already added to the domain in Win 7 and I was logged into the domain administrator account when I did the upgrade to Win 10. Now when I am logged in with the domain...
Good day all I followed these instructions this morning to try to install software for my wifi adapter that windows 10 keeps on blocking. Administrator account - Enable or Disable in Windows 10 - Windows 10 Forums=User%20Accounts I logged out...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:54.
Find Us