A repeated logon failure error for a strange username in the Event viewer of 2003 server RRS feed

  • Question


    I have this repeated error about 150 times every two days in app. The server is a domain controller and Data server:


    The server was unable to logon the Windows NT account 'zackary' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.


    Source: MSFTPSVC

    Type: Warning

    Event ID: 100


    The NT account mentioned changes every day, one day it's "home" one day it's "web4", etc.


    This is a behavior of a spy ware, I scanned the server with an antispyware program it gives me that the server is clean.


    So I guessed that the spy ware is on another machine in the network, but the strange thing is that the other domain controller does not have this error.


    I searched the provided link, microsoft, and google, no related information.


    Have any one encountered this error, Please advice.


    Kind Regards,

    mahmoud terzaki


    Thursday, March 6, 2008 8:05 AM