"LeeG" <lee.gorton(removethis)@hotmail.co.uk> wrote in message
news:6950E8E5-094C-477D-B9E2-69656AB1599A@microsoft.com...
>I have been looking through my event logs and came across this event:
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: System Event
> Event ID: 515
> Date: 21/05/2008
> Time: 17:12:55
> User: NT AUTHORITY\SYSTEM
> Computer: HOME
> Description:
> A trusted logon process has registered with the Local Security Authority.
> This logon process will be trusted to submit logon requests.
>
> Logon Process Name: RASMAN
>
> I am not sure where this has come from! Can anyone tell me?
>
A quck search on the internet reveals that RASMAN is the name of the Remote
Access Security Manager. If, that is, some malware did not create it.

I would disable the account and wait for further developments unless I had
installed an update about that time.

Jim