Network PC Repeated Login Fails

[senator685]

Hi

I have configured Network Access Protection to ban an IP address after 5 incorrect logins. For a while now I have noticed that every so often my own computer on the LAN has its IP address added to the banned list. The NAS is not accessible from the Internet. When I check the QNAP Connection Logs I see the 5 failed login attempts which then trigger the IP address ban. These are SAMBA connections and seem to occur at random intervals, usually every few days and at different times of day.

The Connection Log does show the username which has been used to attemtpt to login, and this is showing my own email address. I do not have my email address configured as a username on the NAS, but this makes me think it may be something I have configured locally at some stage which is trying to connect to the NAS.

In the Windows Logs (Event Viewer) I can locate some failed logins (thought these don't always seem to align exactly with the times of the failed logins I'm seeing in QNAP's own Connection Log) but I can't figure out how to tell which application is actually trying to connect. I guess this may be more of a Windows query, but does anyone know how I can determine which application is trying (unsuccessfully) to connect to the NAS?

I could disable Network Access Protection, but I feel that doesn't really address the problem, or help me determine what's responsible for the failed connections. And I guess I'm concerned there may be some malware trying to connect, though I'd prefer not to wipe my computer and start from scratch as I feels its more likely just some benign program I might have used some time ago trying to connect to the NAS with bad credentials. I have also tried removing all saved credentials for network shares, but something keeps trying to connect with those incorrect credentials at random intervals.

This is slowly driving me nuts so any help how I can identify the applicaiton or process responsible would be greatly apprecaited!

Thanks in advance.

[dolbyman]

check the windows credential storage to see if that username is saved in there

If that is already what you cleaned up, then check the running or scheduled services for programs teying to connect