Windows SBS 2003 Security Failure Audit 529

Powerhousecomputing
Powerhousecomputing used Ask the Experts™
on
I am getting these in the event logs daily in the hundreds:

Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      Administrator
       Domain:            MYDOMAIN
       Logon Type:      2
       Logon Process:      Advapi  
       Authentication Package:      Negotiate
       Workstation Name:      SERVER
       Caller User Name:      SERVER$
       Caller Domain:      MYDOMAIN
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID:      2716
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -

All the googling i have done so far is pointing to it being some kind of malware. I have run a full scan with Eset for Exchange with no warnings. i am also in the process of running a malwarebytes scan. Can anyone help?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Look in processes (Task manager) Process ID 2716.
It may be some system process, you will need something like Process Explorer from www.Sysinternals.com (now part of microsoft) to identify exact source.

Author

Commented:
pid is MArc.Core.exe taskmanager also shows MArc.Core2.exe
Search shows that it is process from GFI:
Marc.core.exe with description SvcAttendant is a process file from company GFI Software Ltd belonging to product SvcAttendant.
May be service from GFI was started with wrong password?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial