Re: MYSQL Question

Are you absolutely sure it is "schost.exe"? My guess is that it is
"svchost.exe", so if you searched for information about "schost.exe", but it
is it is "svchost.exe", then you would not find anything useful.

If it is "svchost.exe", the search the Technet for "svchost" to get a
general understanding of what it is.


"JS" <no@xxxxxxxx> wrote in message
news:uSeMDbuIGHA.3176@xxxxxxxxxxxxxxxxxxxxxxx
> Hello All:
>
> Don't know where else to post this so i am hoping someone here might have
> some info. Early this afternoon, we noticed a spike in our bandwidth. A
> closer look show one of our web servers in the DMZ as the culprit. Looking
> at the connections to this server, I found hundreds of connections to a
> process ...schost.exe on port 1429 connecting to distant machines aall
> running mysql.
>
> This is obviously some sort of worm or DOS launched from or against my box
> and I am just trying to find come information on it. The server is running
> windows 2000, IIS5.0, PHP4.83 ....is up to date on all patches and running
> NAV CORP edition with latest Defs.
>
> I need to find out how this worm got dropped and a little more information
> on it and am coming up blank so far. Any information would be appreciated.
>
> Thanks
>


.

Relevant Pages

  • Re: Help - Port 80 being targeted
    ... W2k and XP pro has a limit of only 10 concurrent connections with no way to ... What you're seeing could possibly be a nimda or code red worm scanning your ... IIS, especially the parts about deleting unnecessary files. ... server even if it has been patched and is not vulnerable. ...
    (comp.security.firewalls)
  • Re: MYSQL Question
    ... >> connections to a process ...schost.exe on port 1429 connecting to distant ... >> machines aall running mysql. ... >> This is obviously some sort of worm or DOS launched from or against my ... The server is ...
    (microsoft.public.sqlserver.security)
  • MYSQL Question
    ... at the connections to this server, I found hundreds of connections to a ... running mysql. ... This is obviously some sort of worm or DOS launched from or against my box ... The server is running ...
    (microsoft.public.sqlserver.security)
  • Re: SBS 2003 IIS BASED SERVICES FAIL INTERMITTENTLY
    ... If I read your post correctly, you have a switch where the SBS ... Run DHCP server on your SBS, and set all client machine nics to dynamic. ... Once you have your nics configured, run the Connect to the Internet wizard, ... QUESTION1 - what is REFUSING CONNECTIONS? ...
    (microsoft.public.windows.server.sbs)
  • Re: SBS Exchange 2003: too many "Current Sessions" opened
    ... So far everything is good and now I'm just monitoring my exchange. ... get the SMTP service to stop hanging in the first place. ... won't have dead connections. ... work for now until I put into production new server hardware with sbs 2003 ...
    (microsoft.public.windows.server.sbs)