中午时分我醒来发现我的电脑没锁，尽管我记得前一天晚上锁过电脑，之后就没用过。我查看了安全日志，发现上午 11:16 有一个“登录”事件。唯一的问题是，当时我睡着了，其他能访问我电脑的人都不知道我的密码。为了安全起见，我运行了病毒扫描，但到目前为止还没有发现任何病毒。到底发生了什么？
事件日志条目的文本如下。
顺便说一下，我检查了一下是我记得昨晚锁定计算机时发生了“注销”事件。
日志条目：
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 1/29/2014 11:16:10 AM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: FLARNDT
Description:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: FLARNDT$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Type: 5
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x188
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2014-01-29T16:16:10.375881200Z" />
<EventRecordID>96945</EventRecordID>
<Correlation />
<Execution ProcessID="380" ThreadID="8756" />
<Channel>Security</Channel>
<Computer>FLARNDT</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">FLARNDT$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">
</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x188</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
</EventData>
</Event>
答案1
我不知道有任何编程方法可以从正在运行的程序（如病毒，除非它严重破坏了 Windows 安全堆栈）中解锁工作站。除了键盘上的某个人之外，还有可能使用可以发送击键的远程控制软件，而病毒有时会附带这些软件。即使在这种情况下，攻击者仍然需要知道您的密码。
专门查找“安全审核”事件，事件 ID 为 4800（锁定）和 4801（解锁）。这些事件将直接与您的会话的实际锁定和解锁相关...其他登录/注销事件经常在后台生成，用于您不一定期望的事情。