-3

My laptop was left at someone else's house and I know they tried to enter the laptop because of the audit logs below, what I don't know and asking is what did they do on my laptop, did they hack it or steal any data?

The suspicious audit logs Event viewer/Security: I looked for filter event ID 4624 which I read is a successful log in and found the following during the time the laptop was there: The first one: Security id: null sid account name - account domain - logon ID 0x0 logon type 0 newlogon: security id: system account name: system account domain: nt authority logon ID 0x3e7 logon GUID (a lot of zeros) process information: process id: 0x4 process name : blank network information: all blank detailed autentication information: all blank and key length 0

second: security id: system account name: name-PC$ account domain: workgroup logon type: 5 security id: system account name: system account domain: nt authority logon id: 0x3e7 (a lot of zeros) process information: process id: 0x288 process name : c:/windows:/system32/services.exe network information: all blank detailed autentication information: logon process: advapi auhentication package:negotiate key length 0

third: same as above but logon id 0x3e7 logon type 5 new logon security id network secrvice account domain nt authority logon id 0x3e4 process id 0x288 name : c:/windows:/system32/services.exe network information: all blank detailed autentication information: logon process: advapi auhentication package:negotiate key length 0

same as above logon id 0x3e7 logon type 5 new logon: seurity id: system account domain: nt authority logon id: 0x3e7

same as above but security id: local service authority domain: nt authority logon id: 0x3e5

security id: system account name: name-PC$ account domain: workgroup logon type: 5 security id: system account name: system account domain: NT AUTHORITY logon id: 0x3e7 (a lot of zeros) process information: process id: 0x288 process name : c:/windows:/system32/services.exe network information: all blank detailed autentication information: logon process: advapi auhentication package:negotiate key length 0

there are several copies of the above.

security id: NULL SID security logon: 0x0 logon type 3 security id: anonymous login account domain: nt authority logon type: 0x2c405 logon guid (00000000-0000-0000-000--000000000) process id 0x0 logon process NtLmSsp authorication package NTLM package name NTLM V1 key length 0

and again another security system id logon type 5 domain nt authority login id 0x3e7 advapi package negotiate key length 0. That's all for the Security Tab.

In the Application Tab, after the time in the first event id 4624 the user profile service has started successfuly. software licensing service is starting theeventsystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. the suppression timeout can be controlled by a reg_dword windows management instrumentation device started successfully IANNTmon exe (part of raid monitor of intel but I don't even have that on my laptop I searched all the files) in the event properties it says "create volume from existing hard drive wizard version:.." usage: unknown hard drive. usage status: normal device port: 0. cd dvd/drive then it lists my cd /dvd drive or someone else's Extensible Storage Engine (ESENT) started a new instance. security-licensing-slc processes these policies are being excluded policy name. telnet. completed status check, then the right of windows right consumption is and later the software licensing service has started. the windows search service started windows security center service has started this is all for the application tab.

The system tab has the following: eventlog microsoft windows service pack 2 multiprocessor free other event logs with binrary code I tried binarytranslator d com but it just showed question signed and @ symbol. filtermanager 'fileinfo' and 'sbfslock' successfully loaded and registered with filter manager two tcpip processes WITH "the system has detected that network adapter loopback pseudo-interface 1 was connected to the interwork and has intitated normal operation" what does that mean?

two of these: event id 4: kernel process power 2 idle states 4 performance states 8 throttle states

Net NDPMP3 (network data mangement protocol) service entered the WIFI AGN state? ethernet controller process says : authonegotiation mode 2 and then port a is down in another process. NDMP4 filtermanager again with file system filter "luafv loaded and registered with filter manager. UAC File Virtualization (luafv)

wlan auto config service started. time service ntpclient was unable to set a manual peer to use as a time source because of the DNS resolution error on time.windows.com?

distributedCOM started the service BITS with argument "" in order to the the server: {server number and letters}. Distributed Component Object Model and BITS is Background Intelligent Transfer Service ?

a lot of other service control manager processes saying "the plug and play service entered the running state" the logon session broker local communication channel. dco server process launcer. remote procedure call . windows defender windows event log. multimedia class scheduler. the user profile service. group policy client. the themes. software licensing service. the COM+ event system. the displaylink service. tablet PC input service. the windows driver foundation. network store interface. TCP/IP netbos helper service. cng key isolation. dns client. extensible autentication protocol. DHCP client. wlan autoconfig. the shell hardware detection. . and MANY OTHERS all entered running state, if you need the complete list let me know.

trusted platform module security service cannot be found on this computer. could not be started. kernel power: the system is entering sleep (this is after 10 minutes or so?) 12+ hours later: ntpclient was unable to set a manual peer to use as a time source because of dns ersolution error on time.windows.com. windows update entered running state. windows defender scan started. power-troubleshooter source the system has resumed from sleep (but the sleep and wake time is the same) and wake source: RTC

A minute later: ethernet source : port A is down. kernel power source: the sytem is entering sleep. no other system processes .

If I go by the times, both security and application tabs only list the processes that I listed above and the times for the processes are within 10-15 minutes. The system tab is the same but also lists a few other processes I listed above for 12+ hours after the time they first tried or enter for another 5-10 minutes. Does that mean they did something for 10-15 minutes then continued later for another 10 minutes? What did they do with my laptop? Did they successfully enter? Did they hack or steal any data?

closed as too broad by Steve, LvB, Anders, Bacon Brad, Jedi Jun 24 '17 at 14:54

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

account name: system

account domain: NT AUTHORITY

security id network secrvice

account domain nt authority

These are Windows' default system/service accounts logging in to run stuff. It probably woke up from a scheduled task, ran something (check for updates, time sync, security scan, etc.) and went back to sleep. You should be able to find out why/what is waking the computer. See here for details.

Not the answer you're looking for? Browse other questions tagged or ask your own question.