Chinese Characters in Netlogon.log -- re-asking

Question

We have  822 occurrences of the following:
[CRITICAL] I_NetlogonLdapLookup: unrecognized character <Chinese characters>
in the last 2 days. The previous thread on this subject was marked "Answered" without being answered, so I'm re-asking:
1. Does anyone have any substantive information about what's sourcing this?
2. How can I associate a source IP with a single entry in the netlogon.log?
Here's what we know so far:
We have a Chinese linguist who has broken the character string down to 2 sections, the first being the same for all occurrences and the second being random-looking. He says the first section refers to "boats" or "water" and is looking
farther, but he says the string definitely looks like virus-like activity.
Second, I_NetlogonLdapLookup is a function inside netlogon.dll, so intuition says something is trying to do an LDAP lookup on the Chinese character string. We are looking into exactly how that function is supposed to be called (we're network guys, not
coders, so this may take longer than it should). Can someone help shorten this search?
C: There's no consistent contextual activity surrounding the actual log entries, so we're expecting to find out that there's  more than one source, so it's extra important we figure out how to associate a source IP with these [CRITICAL] log entries,
especially since we may be looking for a root kit or something else that's able to hide from our multiple AV programs.
Assistance is appreciated, good analytical step-oriented result-generating assistance is GREATLY appreciated!
Robert
Oh yeah -- this is being logged on a DC in a 2008R2 domain with a small but growing number of 2012 member servers and almost no remaining servers lower than 2008R2. I can provide more details if anyone needs them

Answer 1

Hi all --
OK. It looks like we're all on the same page.
Here's a summary of the issue:
netlogon.log [CRITICAL] entry is  reporting a failed attempt to execute an LDAP lookup on a Chinese character string (I_NetlogonLDAPLookup is a function inside netlogon.dll). There are no audit failures or other Event Log warnings or errors associated
with the log entries, so it's likely that the lookup is being performed after logging on to the domain with valid credentials. We don't think the character string is corrupted data because the first half of the string is identical in every
log entry and the total number of characters used across all occurrences is very small). Also, the variations in the 2nd half of the string are methodical and repetitive.
We hoped that translating the Chinese string would yield a clue pointing to the source of the attempted LDAP lookup. That didn't happen so we now must figure out how work back from the netlogon.log entry to the source platform.
The current situation:
The [CRITICAL] entries continue to be logged.
The distribution across 3 days of logs is making it look like we need to assume not one, but multiple sources.
I appreciate the standard advice re: 3rd-party AV software, DC build practices, security scans, power erasers and the like, but we are a QA/Test lab for a very complex product; scientific method and the need for operational stability preempts
us taking any corrective actions on any of our DCs (8 machines, 4 domains, 2 forests), Exchange servers (4 versions, 2 clusters per version) , Lync (2 versions), OCS, PKI, WSUS, DNS, DHCP, DHCPv6, SQL, or member servers until we actually prove that the machine in
question is a source of the bogus lookup attempts.
Paul -- I REALLY appreciate your straightforward no-bs reply. I can work with "I don't know" . Try-this-article-I-just -Googled Whack-A-Mole easter egg hunts, however....   <grin>
I'm going to close with one last (hopefully ) simple question: Where do I start the search for the UberSME who knows how to read the netlogon.log - specifically how to connect an event with its legitimate predecessor. Somebody
wrote the service, somebody knows how to interpret its logging output. Where do I start looking for them?
Best Regards,
Robert