Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have windows 2003 server.with 15 client desktop's.licensed AV is installed on all the pc's including server.there are three desktop's in another branch using the SQL database from this server VIA PORT forwarding(static ip).everyday the server gets disconnected from the network,& when this happens the router & switch lights start flashing & even the internet is down.when the server is shut down everything comes to normal.some new services are started, 100's of exe's are generated, unwanted folders are created.i have formatted the server N number of times.installed norton/kaspersky/mcafee/quickheal antivirus but somehow they are unable to detect the attack & the server just crashes.its very time consuming everyday almost 3 to 4 hrs to UP the server & within an hour its attacked.pls help.what are these exe files & services & why it attacks only the server, & what does it do to the router?will installing a firewall help with UTM?

share|improve this question

Is the SQL server the only port you are forwarding? Sounds like someone has compromised your SQL server instance. You should lock down the port. Yes, installing a firewall will help that. You should make sure that the server is up to date with ALL security patches and also change all the passwords on your SQL server.

To narrow things down a little you should check the SQL log to see if there is anything corresponding to the time of the attack(s).

I would also HIGHLY recommend rebuilding the server. With that type of activity your server is most like going to have something left over even after you lock down the network leak.

share|improve this answer
+1 - Assuming the server is found to have been compromised, a complete rebuild and restore of data files only is the only sensible strategy for the server computer itself moving forward. Obviously, you should find out how the compromise happened and patch the vulnerability, as well. – Evan Anderson Nov 7 '09 at 22:43

Are you forwarding only the port for SQL, or are you forwarding everything? If you're forwarding everything that's your problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.