title: Hacking attempt - Windows server 2003
body: <p>I'm seeing some hacking attempts on my office PC. Last Friday my PC restarted twice suddenly and when I logged in, some of my important documents were not there. Just deleted.
  So I checked the Event Viewer to find the reason about this restart.
  I got these logs and I see someone's PC name on that logs. Can anybody explain this to me?</p>
  
  <p>Thank you!</p>
  
  <hr>
  
  <pre><code>Date:7/27/2012   Source:Security
  Time:2.35.26 PM Category:Account Logon
  Type:Success A  Event ID:680
  User:MyPC/Administrator
  Computer: MyPC
  Description:
    Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon Account:Administrator
    Source Workstation:OtherPC
    Error Code:0x0
  </code></pre>
  
  <hr>
  
  <pre><code>Date:7/27/2012   Source:Security
  Time:2.35.26 PM Category:Logon/Logoff
  Type:Success A  Event ID:576
  User:MyPC/Administrator
  Computer: MyPC
  Description:
     Special privileges assigned to new logon:
     User Name:Administrator
     DOMAIN: MyPC
     Logon ID: (0x0, 0x251E985)
     Privileges:SeSecurityPrivilege
     SeBackupPrivilege
     ...
  </code></pre>
  
  <hr>
  
  <pre><code>Date:7/27/2012   Source:Security
  Time:2.35.26 PM Category:Logon/Logoff
  Type:Success A  Event ID:540
  User:MyPC/Administrator
  Computer: MyPC
  Description:
     Successful Network Logon:
     User Name:Administrator
     DOMAIN: MyPC
     Logon ID: (0x0, 0x251E985)
     Logon Type:3
     Logon Process:NtLmSsp
     Authentication Package:NTLM
     Workstation Name:OtherPC
     Logon GUID:-
     Caller User Name:-
     Caller Domain:-
     Caller Logon ID:-
     Caller Process ID:-
     Transited services:-
     Source Network Address:192.168.x.x
     Source Port:0
  </code></pre>
  
  <hr>
  
  <pre><code>Date:7/27/2012   Source:Security
  Time:2.35.26 PM Category:Logon/Logoff
  Type:Success A  Event ID:551
  User:MyPC/Administrator
  Computer: MyPC
  Description:
     User initiated logoff:
     User Name:Administrator
     DOMAIN: MyPC
     Logon ID: (0x0, 0x2059c)
  </code></pre>
  
  <hr>