locked
A repeated logon failure error for a strange username in the Event viewer of 2003 server RRS feed

  • Question

  •  

    I have this repeated error about 150 times every two days in app. The server is a domain controller and Data server:

     

    The server was unable to logon the Windows NT account 'zackary' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.

     

    Source: MSFTPSVC

    Type: Warning

    Event ID: 100

     

    The NT account mentioned changes every day, one day it's "home" one day it's "web4", etc.

     

    This is a behavior of a spy ware, I scanned the server with an antispyware program it gives me that the server is clean.

     

    So I guessed that the spy ware is on another machine in the network, but the strange thing is that the other domain controller does not have this error.

     

    I searched the provided link, microsoft, and google, no related information.

     

    Have any one encountered this error, Please advice.

     

    Kind Regards,

    mahmoud terzaki

     

    Thursday, March 6, 2008 8:05 AM