Hi I am trying to find a comprehensive all-event logging for windows 10. This doesn't have to be a product, it can be a script. I don't care.

Problem: My pc is being attacked continuously but the logs are being altered and I need to get some additional information about what is being changed.

Is there an open source type software or a script I can use to continuously monitor file changes independently of event log?

What I need: Not an event log rehashed but an independent timestamped log of any file changes on my pc.

Many thanks

closed as off-topic by techraf, John Wu, Anders, Xander, grochmal Dec 28 '16 at 19:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • link – John Wu Dec 28 '16 at 12:41
  • 3
    You can try logging, but as the attacker already has full control, logs can always be altered. If you monitored the network traffic from a different device, however, that can serve you valid information about what the attacker really wants. – Rápli András Dec 28 '16 at 13:10
  • You would be better served asking about how to stop the attacks. What makes you think you are "continuously" attacked? Many such "attacks" are actually hardware issues. – Julian Knight Dec 28 '16 at 17:53

Based on experience, I'd say that it is not that likely that you are being continuously attacked, check for hardware errors, especially disk corruption causing odd errors before assuming an attack as that is far more likely.

However, to answer the actual question, one way would be to install a Syslog Agent so that Windows events are passed out to a syslog server. You will need to configure such a server of course but that is easily done using a Linux computer which could be a simple single-board computer such as a Raspberry Pi.

Solar Winds provide a simple syslog agent for free. THere are other options of course.

  • Thanks, I do think it is something wrong because it happens on multiple pcs including one straight from the store that was just put on my network. – karen popper Dec 30 '16 at 9:31
  • How are you connected to the internet? If by a router, try a factory reset on the router, preferably update to the latest firmware or, even better, move to open source firmware if the router supports it. Of course, change the default admin id/password BEFORE connecting the router to the Internet. – Julian Knight Dec 30 '16 at 11:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.