Today I opened TCPView to see what was causing a lot of outbound network activity and could only identify svchost.exe on port 3389 (which i understand to be the port used by remote desktop).

I ended the process almost immediately.

I've searched for the IP address it was connected to, and discovered it originates in South Korea.

I have just discovered in the Windows Event Viewer under "Applications and Services Log > Microsoft > Windows > TerminalServices-RemoteConnectionManager" almost 2,000 events which read similar to:

Remote Desktop Services: User authentication succeeded:
User: administrator
Source Network Address:

This goes on with users such as sales3, secret3, shop3 - all succeeded.

I wanted to know as it seems my system has been compromised; is at all possible for me to track any activity, such as file access/modification.

And can anyone advise on the best course of action to take to prevent this happening in future?

Bummed me out of my festive spirit

  • Assuming this is a home system, you might want to look at the port forwarding settings on your DSL router to restric external sources initiating a connection to your computer.
    – daya
    Commented Dec 23, 2012 at 18:56
  • bleepingcomputer.com/tutorials/… "How to determine what services are running under a SVCHOST.EXE process" Maybe this gets you some more info
    – Jan Doggen
    Commented Dec 23, 2012 at 19:43
  • Running a scan with avg in safe mode. I've disabled remote desktop even though I used it often while away from home. I find it strange that the logs report successful logon for users that don't exist on my system. Commented Dec 23, 2012 at 19:48

2 Answers 2


First, you should download a good antivirus and antispyware, upgrade with the latest definitions and do a thorough scan of the system (in safe mode). And 'better, before scanning, disable the ASR. Avoid making home banking and operations that require information confidential until it does not solve the problem ... you might have a keylogger on your system.


This is due to your remote settings allowing any RDP client to connect (Ubuntu RDP client/connection as an example). I just replicated this on my end. It will say authentication succeeded, but in reality, all that happened was the RDP client remotely connected to the Windows Login screen but wasn't able to log in to the system.

Your system is more than likely fine. Just turn on NLA authentication only for remote settings to be more secure.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .