1

Hi I am trying to find a comprehensive all-event logging for windows 10. This doesn't have to be a product, it can be a script. I don't care.

Problem: My pc is being attacked continuously but the logs are being altered and I need to get some additional information about what is being changed.

Is there an open source type software or a script I can use to continuously monitor file changes independently of event log?

What I need: Not an event log rehashed but an independent timestamped log of any file changes on my pc.

Many thanks

karen popper
  • 21
  • 3
  • link – John Wu Dec 28 '16 at 12:41
  • 3
    You can try logging, but as the attacker already has full control, logs can always be altered. If you monitored the network traffic from a different device, however, that can serve you valid information about what the attacker really wants. – Rápli András Dec 28 '16 at 13:10
  • You would be better served asking about how to stop the attacks. What makes you think you are "continuously" attacked? Many such "attacks" are actually hardware issues. – Julian Knight Dec 28 '16 at 17:53

1 Answers1

1

Based on experience, I'd say that it is not that likely that you are being continuously attacked, check for hardware errors, especially disk corruption causing odd errors before assuming an attack as that is far more likely.

However, to answer the actual question, one way would be to install a Syslog Agent so that Windows events are passed out to a syslog server. You will need to configure such a server of course but that is easily done using a Linux computer which could be a simple single-board computer such as a Raspberry Pi.

Solar Winds provide a simple syslog agent for free. THere are other options of course.

Julian Knight
  • 7,132
  • 19
  • 23
  • Thanks, I do think it is something wrong because it happens on multiple pcs including one straight from the store that was just put on my network. – karen popper Dec 30 '16 at 09:31
  • How are you connected to the internet? If by a router, try a factory reset on the router, preferably update to the latest firmware or, even better, move to open source firmware if the router supports it. Of course, change the default admin id/password BEFORE connecting the router to the Internet. – Julian Knight Dec 30 '16 at 11:06