Powerhousecomputing
asked on
Windows SBS 2003 Security Failure Audit 529
I am getting these in the event logs daily in the hundreds:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MYDOMAIN
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: SERVER
Caller User Name: SERVER$
Caller Domain: MYDOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2716
Transited Services: -
Source Network Address: -
Source Port: -
All the googling i have done so far is pointing to it being some kind of malware. I have run a full scan with Eset for Exchange with no warnings. i am also in the process of running a malwarebytes scan. Can anyone help?
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: MYDOMAIN
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: SERVER
Caller User Name: SERVER$
Caller Domain: MYDOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2716
Transited Services: -
Source Network Address: -
Source Port: -
All the googling i have done so far is pointing to it being some kind of malware. I have run a full scan with Eset for Exchange with no warnings. i am also in the process of running a malwarebytes scan. Can anyone help?
ASKER
pid is MArc.Core.exe taskmanager also shows MArc.Core2.exe
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
It may be some system process, you will need something like Process Explorer from www.Sysinternals.com (now part of microsoft) to identify exact source.