i found this in my event log not sure if im
the source seems potentially dangerous
The service control manager (SCM) is started at system boot. It is a remote procedure call (RPC) server, so that service configuration and service control programs can manipulate services on remote machines.
i looked in the security event log and i cant find any correlation with the login id
1201 - Time : 11/19/2012 11:02:52 PM 1202 - Source : Service Control Manager 1203 - Description : An account was logged off. Subject: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: 0x13e82ef Logon Type: 3