Steve,

> Sounds like you might possibly have a rootkit of some sort on the workstation.  In that case the following sites have great resources for detecting many of the more well known rootkits:
>
> http://www.systernals.com (RootkitRevealer, ProcExp, TCPView)

Thanks.  I tried RootkitRevealer, it found nothing.  I have not tried the
other tools yet.

But back to the question:  Could a rootkit allow an attacker to log in over
the network and yet have it show up as a console logon in the security log?
This is really a question about the Windows security log and what it means.

-- David McFarlane
  Systems Designer
  Michigan State University, Dept. of Psychology
  [log in to unmask]