Can't Access SQL Server

[Neil Ginsberg]

Help! I've been hacked! I'm running SQL 7 Desktop (MSDE) and started getting
these messages at startup that servudaemon.exe was going to be shut down.
Then, at one point, I keep getting prompted by Norton Firewall that
serve-u.exe is trying to access the Internet. It suggested I deny it, which
I did; but I kept getting prompted every minute or so, so finally I told
Norton Firewall to always deny it.

Then, some minutes later, I close an Access 2000 mdb file I had opened which
uses SQL Server as a back end (through linked tables), and I was told that
connection to SQL Server had been lost. I tried reconnecting, but couldn't.
So I went into Enterprise Manager, and was told: "A connection could not be
established to D23 - Login failed for user 'sa'.."

So I went into Registration Properties, and saw that there was a password
there. I previously didn't have a password for 'sa' (which I know is stupid,
and now see the result of it). But there's a password now, and I can't
change it. So whatever hacked into my system set my 'sa' password.

Just to be sure that my settings in Norton Firewall weren't affecting
anything, I disconnected from the Internet and then disabled Norton Personal
Firewall. The results were the same.

So is there any way to restore my system?

Thanks for any assistance.

Neil

 

[MGFoster]

Help! I've been hacked! I'm running SQL 7 Desktop (MSDE) and started getting
these messages at startup that servudaemon.exe was going to be shut down.
Then, at one point, I keep getting prompted by Norton Firewall that
serve-u.exe is trying to access the Internet. It suggested I deny it, which
I did; but I kept getting prompted every minute or so, so finally I told
Norton Firewall to always deny it.

Then, some minutes later, I close an Access 2000 mdb file I had opened which
uses SQL Server as a back end (through linked tables), and I was told that
connection to SQL Server had been lost. I tried reconnecting, but couldn't.
So I went into Enterprise Manager, and was told: "A connection could not be
established to D23 - Login failed for user 'sa'.."

So I went into Registration Properties, and saw that there was a password
there. I previously didn't have a password for 'sa' (which I know is stupid,
and now see the result of it). But there's a password now, and I can't
change it. So whatever hacked into my system set my 'sa' password.

Just to be sure that my settings in Norton Firewall weren't affecting
anything, I disconnected from the Internet and then disabled Norton Personal
Firewall. The results were the same.

So is there any way to restore my system?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You have to log on as a system admin or if your PC is not on a network
as the local admin. SysAdmins have over ride permissions to SQL
Server. Change the sa login (obviously). You can also change the
port that SQL'r uses (1433 default) to avoid obvious port attacks.

More info is in the Books On Line (BOL) documentation. See the
chapter "Administering SQL Server" in the Contents tab of BOL.

- --
MGFoster:::mgf00 <at> earthlink <decimal-point> net
Oakland, CA (USA)

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA+AwUBQFUBCYechKqOuFEgEQLgJwCfUdp1dsY8uxkgjWARUC/5taYEh0YAlR8Z
yv+KeZWi8TbMcQN2+CQ/lnM=
=Jrd8
-----END PGP SIGNATURE-----