Re: MYSQL Question

yes
"Sam Hobbs" <samuel@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ejMm9axIGHA.2668@xxxxxxxxxxxxxxxxxxxxxxx
> Are you absolutely sure it is "schost.exe"? My guess is that it is
> "svchost.exe", so if you searched for information about "schost.exe", but
> it is it is "svchost.exe", then you would not find anything useful.
>
> If it is "svchost.exe", the search the Technet for "svchost" to get a
> general understanding of what it is.
>
>
> "JS" <no@xxxxxxxx> wrote in message
> news:uSeMDbuIGHA.3176@xxxxxxxxxxxxxxxxxxxxxxx
>> Hello All:
>>
>> Don't know where else to post this so i am hoping someone here might have
>> some info. Early this afternoon, we noticed a spike in our bandwidth. A
>> closer look show one of our web servers in the DMZ as the culprit.
>> Looking at the connections to this server, I found hundreds of
>> connections to a process ...schost.exe on port 1429 connecting to distant
>> machines aall running mysql.
>>
>> This is obviously some sort of worm or DOS launched from or against my
>> box and I am just trying to find come information on it. The server is
>> running windows 2000, IIS5.0, PHP4.83 ....is up to date on all patches
>> and running NAV CORP edition with latest Defs.
>>
>> I need to find out how this worm got dropped and a little more
>> information on it and am coming up blank so far. Any information would be
>> appreciated.
>>
>> Thanks
>>
>
>


.

Relevant Pages

  • Re: Help - Port 80 being targeted
    ... W2k and XP pro has a limit of only 10 concurrent connections with no way to ... What you're seeing could possibly be a nimda or code red worm scanning your ... IIS, especially the parts about deleting unnecessary files. ... server even if it has been patched and is not vulnerable. ...
    (comp.security.firewalls)
  • Re: MYSQL Question
    ... > at the connections to this server, I found hundreds of connections to a ... > running mysql. ... > This is obviously some sort of worm or DOS launched from or against my box ... The server is running ...
    (microsoft.public.sqlserver.security)
  • MYSQL Question
    ... at the connections to this server, I found hundreds of connections to a ... running mysql. ... This is obviously some sort of worm or DOS launched from or against my box ... The server is running ...
    (microsoft.public.sqlserver.security)
  • Re: SBS 2003 IIS BASED SERVICES FAIL INTERMITTENTLY
    ... If I read your post correctly, you have a switch where the SBS ... Run DHCP server on your SBS, and set all client machine nics to dynamic. ... Once you have your nics configured, run the Connect to the Internet wizard, ... QUESTION1 - what is REFUSING CONNECTIONS? ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote access problem
    ... CEICW setting RWW is OK. ... I clicked "Connect to server desktops" and got the screen with all the ... Remote connections ... > Internet Connection wizard' to configure the server networking settings? ...
    (microsoft.public.windows.server.sbs)