I have a windows 2003 server and time to time I am getting many login failures like this one.

Logon Failure:
    Reason:     Unknown user name or bad password
    User Name:  administrator
    Domain:     xx.xx.xx.xx
    Logon Type: 3
    Logon Process:  NtLmSsp 
    Authentication Package: NTLM
    Workstation Name:   XLHOST
    Caller User Name:   -
    Caller Domain:  -
    Caller Logon ID:    -
    Caller Process ID:  -
    Transited Services: -
    Source Network Address: 173.45.70.100 <- hacker
    Source Port:    4722

AND

Logon attempt by:   MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account: user
 Source Workstation:    XLHOST
 Error Code:    0xC0000064

The question is, how can I close this process of login ?, what I have left open and some one can try to login ?

Some notes:
I login to the server using tunneling, nothing is open except dns, email, and web ports, not even ftp, and all default ports are change and hidden. I also monitor port scan and capture any one that try to find the hidden ports.

Probably it is something open...

Thank you in advanced.