Event log fills up with these entries

I get about 3 of these entries every few seconds.


Event ID: 560
Source: Security

Type: Failure Audit
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,4256439}
Process ID: 572
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: SERVER$
Primary Domain: DOMAINNAME
Primary Logon ID: (0x0,0x3E7)
Client User Name: username
Client Domain: DOMAINNAME
Client Logon ID: (0x0,0x6E4BE)
Accesses: Connect to service controller

Privileges: -
Restricted Sid Count: 0


Before I started getting these, I was first getting similar entries but with Object Type being SERVICE OBJECT and Object Name being RasMan, to “Query status of service” and “Start the service”. This is especially strange to me because I have had RasMan disabled for ages, and have not installed any software that (to my knowledge) would require this service. I tried to google these event entries, but they didn’t help much as they all seemed to point to Windows Server, which I am neither running nor connected to.

Might someone have any idea why these events are popping up, and whether they’re indicative of malware? My OS is XP SP3.

According to Technet is seems a configuration issue:
http://support.microsoft.com/kb/841001