Advapi [please help understand Sucurity Event logged]

coop · 2005/01/25

Advapi seems to by accessing my computer - a search shows it is a virus - but McAffee is not catching it and a search for advapi.exe turns up nothing (even search system folders and hidden files). Also advapi.exe does not show up in running processes or boot processes.

I'm not sure what it is, but it generates events 528 and 576 like crazy. Usually these events happen in bursts - several times per hour.

From what I can tell, advapi is a legit WIN opperation. I cannot find any specific reference to this event as a virus or trojan, but I am not sure what else it could be.

This is a typical event:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 1/25/2005
Time: 7:04:00 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HAL2000
Description:
Successful Logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Logon Type: 5
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 1/25/2005
Time: 7:04:00 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HAL2000
Description:
Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Click to expand...

Is there a step-by-step available to getting rid of this thing? Below is a bit of my Event Viewer log and a summary of the typical entries.

Type Date Time Source Category Event User Computer
Success Audit 1/25/2005 7:04:00 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:04:00 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:46:36 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:46:36 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:18 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:18 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:39:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:39:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Click to expand...

Suggestions? Thank you in advance.
Click to expand...

Christer · 2005/01/25

coop,
maybe I sent You on a wild goose chase but better safe than sorry!

I found the Microsoft articles below which describes the events:

Security Event Descriptions

Privilege Use Events

Search results id 576

Search results id 528

Christer

coop · 2005/01/25

Christer said:

coop,
maybe I sent You on a wild goose chase but better safe than sorry!

I found the Microsoft articles below which describes the events:

Security Event Descriptions

Privilege Use Events

Search results id 576

Search results id 528

Christer
Click to expand...

Yeah - it appears to be legit proceses - but I do not understand why there are so many. Maybe, as suggested by the one article, I have settings that are too sensative and record various innocuous events?

Arie · 2005/01/25

Please follow Posting Rules (#3 - Meaningful Subject) when posting.

I have adjusted your subject.

jirobert · 2005/02/19

ADVAPI Problem

I have the same ADVAPI problem on my XP loads. Does anyone know if this is a legit process? The ADVAPI process runs immediately after installing XP. I did a low level format on the drive before loading it. The computer is not connected to the internet. All security prone services were disabled during the installation.

I have a Maxtor SATA/150 PIC Card installed because my system board is 100 and the drive is ATA/133. The card has a 10 MB bios. If I have a trojan, the only place it can be living is in the card bios.

If ADVAPI is a Trojan, it's a tough one to kill....

Log in or Sign up

Advapi [please help understand Sucurity Event logged]

coop Inactive Thread Starter

Christer Geek Member Staff

coop Inactive Thread Starter

Arie Administrator Administrator Staff

jirobert Inactive

Share This Page

Log in or Sign up

Advapi [please help understand Sucurity Event logged]

coop Inactive Thread Starter

Christer Geek Member Staff

coop Inactive Thread Starter

Arie Administrator Administrator Staff

jirobert Inactive

Share This Page

Useful Searches