You might find these KB articles helpful:
http://support.microsoft.com/default.aspx?scid=kb;en-us;811889&Product=s
ql2k
http://support.microsoft.com/default.aspx?scid=kb;en-us;282254&Product=s
ql2k
Jorge A. Herrera
MSSQL DBA
Chevy Chase Bank
6200 Chevy Chase Drive
Laurel, MD. 20707
[Email address protected]
-----Original Message-----
From: Jumma Salim
[mailto:mssqldba-ezmlmshield-x79659010.[Email address protected]
Sent: Friday, June 17, 2005 3:10 PM
To: LazyDBA Discussion
Subject: SQL hacking and shutdown no connection
I had auditors trying to hack into my system sql2000 + window 2000
server +
service pack 4 + 4 gb memory
He ran the hacking tool and throws everyone using application on the
server
out
We did a reboot on the server we could not connect now
Her are the log files
SQLAGENT.OUT
2005-06-16 11:12:27 - ? [130] SQLSERVERAGENT stopping because of Windows
shutdown...
2005-06-16 11:12:30 - ! [298] SQLServer Error: 1115, Cannot generate
SSPI
context [SQLSTATE HY000]
2005-06-16 11:12:30 - ! [382] Logon to server '(local)' failed
(SaveAllSchedules)
2005-06-16 11:12:31 - ? [098] SQLServerAgent terminated (normally)
Sqldump001.txt
====================================================================
BugCheck Dump
=====================================================================
This file is generated by Microsoft SQL Server 8.00.760
upon detection of fatal unexpected error. Please return this file,
the query or program that produced the bugcheck, the database and
the error log, and any other pertinent information with a Service
Request.
Computer type is AT/AT COMPATIBLE.
Bios Version is DELL - 1
Phoenix ROM BIOS PLUS Version 1.10 A16
Current time is 07:09:10 05/20/05.
8 Intel x86 level 15, 1993 Mhz processor(s).
Windows NT 5.2 Build 3790 CSD .
Memory
MemoryLoad = 62%
Total Physical = 3583 MB
Available Physical = 1360 MB
Total Page File = 5474 MB
Available Page File = 3557 MB
Total Virtual = 2047 MB
Available Virtual = 297 MB
***Symbol load failed - Proceed to dump without any symbols
*Stack Dump being sent to d:\Microsoft SQL
Server\MSSQL\log\SQLDump0001.txt
*
************************************************************************
****
*
**
*
* BEGIN STACK DUMP:
* 05/20/05 07:09:10 spid 0
*
* Exception Address = 77E649D3
* Exception Code = 400042ac PRINTSTACK
*
* MODULE BASE END SIZE
*
* Edi: 00000000:
* Esi: 00000000:
* Eax: 048AEE38: 400042AC 00000000 00000000 77E649D3 00000000
02860
B80
* Ebx: 00000000:
* Ecx: 048AFA58: 61636F4C 6E6F6974 7520093A 6874736D 632E6472
343A7
070
* Edx: 048AFABE: 00000036 00000000 00000000 FAD00000 9680048A
00001
9DA
* Eip: 77E649D3: 10C2C95E C0658300 90EBEB00 90909090 8DEC8B55
FF500
845
* Ebp: 048AEE88: 048AEEC4 0087C7CA 400042AC 00000000 00000000
00000
000
* SegCs: 0000001B:
* EFlags: 00000246:
* Esp: 048AEE34: 00000000 400042AC 00000000 00000000 77E649D3
00000
000
* SegSs: 00000023:
*
************************************************************************
****
*
**
*
------------------------------------------------------------------------
----
-
--
* Short Stack Dump
* 77E649D3 Module(UNKNOWN+00000000)
* 0087C7CA Module(UNKNOWN+00000000)
* 0087C5BE Module(UNKNOWN+00000000)
* 00931097 Module(UNKNOWN+00000000)
* 41074A04 Module(UNKNOWN+00000000)
* 410721D6 Module(UNKNOWN+00000000)
* 41074EA7 Module(UNKNOWN+00000000)
* 41074698 Module(UNKNOWN+00000000)
* 542868FF Module(UNKNOWN+00000000)
Salim Jumma
954 628 1487 (work)
954 275 6686 (cell)
---------------------------------------------------------------------
TO REPLY TO EVERBODY , PLEASE CLICK REPLY-ALL, NOT JUST REPLY
Website : http://www.LazyDBA.com
To unsubscribe: http://www.lazydba.com/unsubscribe.html
**********************************************************************
Email is to be used for Chevy Chase Bank business purposes only.
Confidential information should not be sent via email as there is no
expectation of privacy or integrity of the message through the Internet.
**********************************************************************
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom
they are addressed. If you have received this email in error
please notify the system manager.
This footnote confirms that this email message has been scanned
for the presence of computer viruses.
Chevy Chase Bank
**********************************************************************
MS Sql Server LazyDBA home page