Terminal Services Under Attack?

[gamehead200]

Well, I just decided to take a quick look at my Event Viewer and noticed a whole bunch of errors...

The terminal server received large number of incomplete connections.  The system may be under attack.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

They were all the same with event 1006. I'm guessing that this is either because someone is port scanning me, or because someone that thinks they are smart and know my password are trying to access my computer via Remote Desktop.

Oh yeah, I have SP2, with the hacked termsrv.dll file. Could this have anything to do with it?

I'm just curious to know... Its not like I'm gonna track down whoever's doing this and send them to jail!

[Alanoll]

you could try replacing you hacked file with the original. Could just be the tiny difference between the files, and XP doesn't know what's wrong.

[gamehead200]

Any other ideas? I just reinstalled XP and the same thing is happening...

[prathapml]

Are you still with the hacked termsrv.dll though (after re-install) ?

Who knows what was embedded in it (if it was downloaded from somewhere) - I always prefer to see what hex-edits are to be made and do it myself. B) Even files that have been around for years, might suddenly be found to have security back-doors! 'Tis not for nothing that NASA insists on 5 year old hardware and software, as a compulsory minimum (atleast, last I heard).

[gamehead200]

Are you still with the hacked termsrv.dll ?

Who knows what was embedded in it (if it was downloaded from somewhere) - I always prefer to see what hex-edits are to be made and do it myself.  B) Even files that have been around for years, might suddenly be found to have security back-doors! 'Tis not for nothing that NASA insists on 5 year old hardware and software, as a compulsory minimum (atleast, last I heard).

Still using that hacked file... I'd like to have the hex-edits also... Do they exist for that file? Haven't been really looking up on this actual file...