I've just uploaded my ASP.NET web app (VS2010, C#, SQL Server2008) to a Win2008Server R2, everything works fine but I think my database is under attack!
SQL Server ERRORLOG constantly writes some messages saying "Error logging user 'sa', password didn't match...." and writes some IP addresses, it seems I'm being attacked, I DO NOT use 'sa' user at all, so I disabled 'sa' user, now message has changes (but attacks still continue), now message is "Error logging user 'sa', error evaluating passowrd...", error no: 18456, severity: 14, state: 7.
What should I do not? Is it safe for me now or they can penetrate my DB? what should I do? I've disable user 'sa', so it is safe? I cannot delete it as I get an error, can anyone enter my DB? please help me If now I'm safe, can I disable SQL ERROR LOG? how? should I block these IPs? if so, how can I do so?