"Neil Ginsberg" <nrg@nrgconsult.com> wrote in message
news:41S4c.37310$aT1.22694@newsread1.news.pas.earthlink.net...
> Help! I've been hacked! I'm running SQL 7 Desktop (MSDE) and started getting
> these messages at startup that servudaemon.exe was going to be shut down.
> Then, at one point, I keep getting prompted by Norton Firewall that
> serve-u.exe is trying to access the Internet. It suggested I deny it, which
> I did; but I kept getting prompted every minute or so, so finally I told
> Norton Firewall to always deny it.
>
> Then, some minutes later, I close an Access 2000 mdb file I had opened which
> uses SQL Server as a back end (through linked tables), and I was told that
> connection to SQL Server had been lost. I tried reconnecting, but couldn't.
> So I went into Enterprise Manager, and was told: "A connection could not be
> established to D23 - Login failed for user 'sa'.."
>
> So I went into Registration Properties, and saw that there was a password
> there. I previously didn't have a password for 'sa' (which I know is stupid,
> and now see the result of it). But there's a password now, and I can't
> change it. So whatever hacked into my system set my 'sa' password.
>
> Just to be sure that my settings in Norton Firewall weren't affecting
> anything, I disconnected from the Internet and then disabled Norton Personal
> Firewall. The results were the same.
>
> So is there any way to restore my system?
>
> Thanks for any assistance.
>
> Neil
>
>

"oj" <nospam_ojngo@home.com> wrote in message
news:IcS4c.9272$1p.200812@attbi_s54...
> 1. Keep your internet connection disabled.
> 2. Start up sqlserver service.
> 3. From command prompt, type the following to change the password for
'sa':
> osql -E -Q"exec sp_password null,'Your_new_Pass','sa'"
>
>
> --
> -oj
> http://www.rac4sql.net
>
>
> "Neil Ginsberg" <nrg@nrgconsult.com> wrote in message
> news:41S4c.37310$aT1.22694@newsread1.news.pas.earthlink.net...
> > Help! I've been hacked! I'm running SQL 7 Desktop (MSDE) and started
getting
> > these messages at startup that servudaemon.exe was going to be shut
down.
> > Then, at one point, I keep getting prompted by Norton Firewall that
> > serve-u.exe is trying to access the Internet. It suggested I deny it,
which
> > I did; but I kept getting prompted every minute or so, so finally I told
> > Norton Firewall to always deny it.
> >
> > Then, some minutes later, I close an Access 2000 mdb file I had opened
which
> > uses SQL Server as a back end (through linked tables), and I was told
that
> > connection to SQL Server had been lost. I tried reconnecting, but
couldn't.
> > So I went into Enterprise Manager, and was told: "A connection could not
be
> > established to D23 - Login failed for user 'sa'.."
> >
> > So I went into Registration Properties, and saw that there was a
password
> > there. I previously didn't have a password for 'sa' (which I know is
stupid,
> > and now see the result of it). But there's a password now, and I can't
> > change it. So whatever hacked into my system set my 'sa' password.
> >
> > Just to be sure that my settings in Norton Firewall weren't affecting
> > anything, I disconnected from the Internet and then disabled Norton
Personal
> > Firewall. The results were the same.
> >
> > So is there any way to restore my system?
> >
> > Thanks for any assistance.
> >
> > Neil
> >
> >
>
>