Thank you for helping me on this issue.

I set a trace on SQL Profiler for EventClass of 'Uer Error Messate' and 'Audit Login Failed'. Got many error messages about 'changed database context to 'dbname' '; and many login failed for ApplicationName of 'Microsoft ® Windows Script Host'...

Here are some examples:

<Event id="162" name="User Error Message">

<Column id="1" name="TextData">Changed language setting to us_english.</Column>

<Column id="9" name="ClientProcessID">9076</Column>

<Column id="6" name="NTUserName">SYSTEM</Column>

<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>

<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

<Column id="12" name="SPID">94</Column>

</Event>

<Event id="162" name="User Error Message">

<Column id="1" name="TextData">Changed database context to 'master'.</Column>

<Column id="9" name="ClientProcessID">8508</Column>

<Column id="6" name="NTUserName">SYSTEM</Column>

<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>

<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

<Column id="12" name="SPID">95</Column>

</Event>

<Event id="20" name="Audit Login Failed">

<Column id="1" name="TextData">Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'model'. [CLIENT: XXXXXXX]</Column>

<Column id="9" name="ClientProcessID">4824</Column>

<Column id="6" name="NTUserName">SYSTEM</Column>

<Column id="14" name="StartTime">2013-09-11T15:27:49.22-05:00</Column>

<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

<Column id="12" name="SPID">88</Column>

</Event>