Somehow sqlservr.exe launches cmd.exe (with very strange command line params) and ftp.exe processes on my PC, please see screenshots. I have already installed antivirus. What it could be, how to treat or fix that? Thanks
migrated from serverfault.com Nov 22 '11 at 22:40
This question came from our site for professional system and network administrators.
That tends to look like you've been compromised ("pwn3d"). That's pretty suspicious activity. I'd get that box off the 'net as quickly as you can, start investigating how the breach might have occurred, and be ready to restore the machine from backup if something persistent has been installed on the box.
There may not be anything persistent installed on your machine (yet). I tend to think there isn't.
It's likely that you've got
If you know you don't need the
It looks like you might be blocking outbound FTP from the server (bravo!) and that's likely preventing the attacker from bringing down their code and running it.
SQL Profiler can show you the queries the attacker is running to cause the