Keep getting login failure for user "inna" on multiple servers

Hi,
Just recently I seem to be getting the same user name appearing as a failed
login "inna", I often get people trying to gain entry to the various servers
that I support but it seems strange that quite often the same one user name
appears at 4 or 5 different sites which are in different locations.

The log entry is like this:

Critical Errors in Security Log


Source Event ID Last Occurrence Total Occurrences
Security 529 09/10/2008 01:35 1
Logon Failure:
Reason: Unknown user name or bad password
User Name: inna
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SERVER01
Caller User Name: SERVER01$
Caller Domain: SIVILL
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3380
Transited Services: -
Source Network Address: -
Source Port: -

Process ID 3380 is "InetInfo.exe" so I assume they are trying to log into my
web server or Sharepoint?

Has anyone seen this before and is it possible it's actually some internal
MS thing that is generating it or whether it really is hackers trying to log
into my servers?



Graham Sivill

--
Martley, Near Worcester, UK
.

Relevant Pages

  • Re: HELP, I cannot figure this one out.......
    ... Make sure that w32time is running on all the servers and that one of them ... > Logon Failure: ... > Logon Process: Kerberos ... > Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Event ID 537
    ... One of my workstations on my SBS2003 network has just recently started ... generating Event ID 537 errors to the servers security log. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: 540,576,538
    ... servers and I don't know what triggers it and why that user. ... I disable the local user and I get an failure to logon now. ... Event Type: Success Audit ... Caller User Name: - ...
    (microsoft.public.security)
  • Re: Hacking Attempts ?
    ... I see this from time to time on client's servers, but I've never seen it when it's just a few attempts, usually we'll see it happen hundreds of times. ... Logon Failure: ... Caller User Name: SERVER1$ ... The user trying to logon was 'webmaster', quite a commom hacker logon. ...
    (microsoft.public.windows.server.sbs)
  • Re: Start again on the newbies networking problem. Re: Need help (of course) setting up network
    ... As you are working on this, do download the latest ... > servers that will help you later. ... ; guest account = pcguest ... ; logon script = %m.bat ...
    (Fedora)
Loading