How do I know when I have a hacker?

[swordsman]

I have a server that's running MS 2000 server. Recently we have been getting funny emails from what looks like a guy at our ISP service. Now we have a user that has established him self in our system. It shows his name to be a long number that's something like: S-1-5-21-60235689411-25464..... instead of a regular name. It stead of a ful colored head next to his name it shows and head with a question mark. Now our system has stopped letting users on other computers with in the network access the server files. Could this be a hacker or did something go wrong with our system? Can anyone recomend any good software for us?

 

[tom11011]

That number is called a sid. Sounds like a user could have been deleted but the changes never replicated through active directory? Check your event logs for clues. Need more information.