Is someone accessing my computer?

[rsgrauer]

Need some help. In my Security Event Viewer Log I am
getting many Event ID #627's with someone trying to change
passwords to various target accounts. I am also getting ID
#529 with something trying to logon to my computer with an
unkown user name or bad password. This happens every few
seconds. I also have an ID #642 that says my Guest User
account has changed. Is this normal? Doesn't seem like
it. Any help is greatly appreciated.

Ryan

 

[Kent W. England [MVP]]

If I were you, I would download and install a personal firewall.

Then I would disable my Guest account and remove/reset any password for
it. I would also disable Administrative shares. Possibly rename the
Administrator account.

I'd also search for trojans. Tauscan or IDS-3 are decent tools.