id="info"

Question

Locked

Rogue Process?

By blarman ·
Has anyone ever come across the sansv.exe process? We found it on our SQL Server (Win 2K3 - fully patched) today after it crippled our internal network with packet traffic. Killing the process seemed to directly relate to a huge drop in server communications (back to normal), but I can't seem to find any information on what it is or where it came from.

It seemed to be generating a lot of traffic over a variety of ports >2500 all destined for a series of seemingly random IP addresses (all outside our network) on Port 129.

Has anyone ever seen this? Is this an exploit? Bug? New Feature? Compromise?

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Back to Networks Forum
2 total posts (Page 1 of 1)  

Hardware Forums