FTP error

[bvahan5]

I am getting errors every second
in Event log it shows the same message

Source MSFTPSVC
Event ID 100

The server was unable to logon the Windows NT account 'Administrator' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:

http://www.microsoft.com/contentredirect.asp.

What does it mean?
does some external computer trying to log in my server cycling attempts with different passwords?

how to resolve this?
my System log gets full in minutes

thx for advices

 

[ScottCr]

Have a look in your IIS logs and see what or who is trying to logon, should point you in your next direction.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[bvahan5]

there are tons of same attempts like

09:17:07 221.111.111.111 [1]USER Administrator 331
09:17:07 221.111.111.111 [1]PASS - 530

I have changed IP here
but IP is all the same in each record

how to block this IP ?

 

[Davetoo]

That IP comes back to a bank in Tokyo:

Registrant Name: SoftbankBB Corp.
Registrant Organization: SoftbankBB Corp.
Registrant Street1: 24-1 Nihonbashi-Hakozaki-cho
Registrant Street2: -
Registrant City: Chuo-ku
Registrant State: Tokyo
Registrant Postal Code: 103-0015
Registrant Country: JP
Registrant Phone: 03-5642-8585
Registrant Fax: 03-5641-3376
Registrant Email: hostmaster@bbtec.net


I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[bvahan5]

again - i HAVE CHANGED IP here


also i noticed that IP is changing from day to day, from one session of attempts to another

so its some dynamic IP of remote user

do you want all these IPs ?

 

[ScottCr]

Do a reverse lookup on a few of the IP's to determine whether they are all from the same ISP or not.

If they are all from the same IP you maybe able to block the entire range at your Firewall.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[ScottCr]

I would also make sure your Administrator password is 'complex' at the very least definately not a word you would find in a dictionary. You don't want someone breaking it while you're trying to stop them.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[bvahan5]

sorry, how to do this reverse lookup?
(i run small server, never needed to do that)
also, i use small firewall within 2Wire router
thx

 

[ScottCr]

No problem, go to

http://www.dnsstuff.com

and use the 'Reverse DNS Lookup' for a number of the IP Addresses.

Do you need to run FTP on this server?

http://scottcross.blogspot.com

Windows and NT Admin.