Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I opened TCPView to see what was causing a lot of outbound network activity and could only identify svchost.exe on port 3389 (which i understand to be the port used by remote desktop).

I ended the process almost immediately.

I've searched for the IP address it was connected to, and discovered it originates in South Korea.

I have just discovered in the Windows Event Viewer under "Applications and Services Log > Microsoft > Windows > TerminalServices-RemoteConnectionManager" almost 2,000 events which read similar to:

Remote Desktop Services: User authentication succeeded:
User: administrator
Source Network Address:

This goes on with users such as sales3, secret3, shop3 - all succeeded.

I wanted to know as it seems my system has been compromised; is at all possible for me to track any activity, such as file access/modification.

And can anyone advise on the best course of action to take to prevent this happening in future?

Bummed me out of my festive spirit

share|improve this question
Assuming this is a home system, you might want to look at the port forwarding settings on your DSL router to restric external sources initiating a connection to your computer. – daya Dec 23 '12 at 18:56… "How to determine what services are running under a SVCHOST.EXE process" Maybe this gets you some more info – Jan Doggen Dec 23 '12 at 19:43
Running a scan with avg in safe mode. I've disabled remote desktop even though I used it often while away from home. I find it strange that the logs report successful logon for users that don't exist on my system. – TerryProbert Dec 23 '12 at 19:48

First, you should download a good antivirus and antispyware, upgrade with the latest definitions and do a thorough scan of the system (in safe mode). And 'better, before scanning, disable the ASR. Avoid making home banking and operations that require information confidential until it does not solve the problem ... you might have a keylogger on your system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.