My server’s been hacked EMERGENCY
I have a compromised machine that is attempting several hundred connections a minute to log into other mssql machines around the world. Event Viewer is showing hundreds of Event ID 18456 errors. It's probably the network service process doing this, the error is below:
Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
My machine is trying to log into other machines. I've previously found a system.exe which notes "Running Multi-Thread SQLck v1.0.00 Beta9_1 - written in only socket commands". It used a .dic file of passwords to brute force the SA password of other machines. I've removed that file from the system, but I believe there's another copy in use.
I can't establish what process within MSSQL is firing this process, and how I can stop it.
How can I stop mssql trying to log into things without my say so? There may be servers it needs to log into to (known hosts), but not these Chinese/Brazillian servers.
Edit: tl;dr: my machine is being used to brute force other servers. How do I stop it?