PC keeps trying to authenticate

[tahoe2]

My bosse's PC keeps trying to connect to our network, even though he's already logged in. Here is the error message:

Event ID 529
User ID NT/Authority System
Source: Security

Failure:
reason: Unknown username or bad password.
username [username] (my bosses ID)
domain: [domainname] (our domain)
logon type: 3
logon process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
workstation name: [wsname] (real ws name, I even changed the name and removed the old machine account from the domain, no change)

There is a failed logon attempt 5 times every minute from this PC. The only time it does not try to authenticate is when the power is off.

I was having trouble with this account and the bluestell* stuff, but I got my server to stop relaying yesterday. Now this.

Any ideas? My boss runs W2K pro and I completely locked it down yesterday, to no avail and to his slight displeasure.

Thanks,
Corie

 

[james3838]

The machine is probably infected with W32.swen.a@mm worm.

Check out

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html

for details

 

[tahoe2]

Well, it's not the virus. It still happens, and I've run NAV with def's I downloaded this morning, as well as every fix and patch I could think of.
No go. Any other ideas?

Corie

 

[james3838]

Since its NTLM, its less likely to be a worm (should have picked up that before). Does he have any POP/IMAP accounts configured with either Outlook or Outlook express?

 

[tahoe2]

No, just SMTP mail through our Exchange 5.5 server.
I'm really at a loss here. There was a trojan from Gator on his system, so I got rid of that, now I need to stop this madness.
thanks again.

Corie