Re: Apparent Security violations recorded in Event Viewer

From: Chris Wood (anonymous_at_discussions.microsoft.com)
Date: 07/26/04 

Date: Mon, 26 Jul 2004 11:10:42 -0600

Pat,

I would at least make sure that you record all failed access attempts. This
can be done by properties - Security tab - Audit level and check Failure.
This way you can see who is trying to get access.

Chris Wood
Alberta Department of Energy
CANADA

"Pat Rogers" <progers@kc.rr.com> wrote in message
news:2ea301c470e0$6a535d50$a401280a@phx.gbl...
> I am receiving the following event in the event viewer. I
> believe that it is from hackers trying to execute Sql
> Statements against my Sql Server to gain access to my
> website. I only have port 80 open via my firewall, so I'm
> confused as to how they are getting in. Does anyone have
> any suggestions?
>
> Any help, ideas, suggestions would be greatly appreciated.
>
> Pat Rogers
>
> Event Type: Information
> Event Source: ODBC Error (388221)
> Event Category: None
> Event ID: 0
> Date: 7/21/2004
> Time: 8:44:23 AM
> User: N/A
> Computer: P6-CR2-SVR
> Description:
> The description for Event ID ( 0 ) in Source ( ODBC Error
> (388221) )
> cannot be found. The local computer may not have the
> necessary registry
> information or message DLL files to display messages from
> a remote
> computer. The following information is part of the event:
> Message Text:
> =============
> SQL Selected Record is invalid: - 00000.
>
>
>