**URGENT ** Massive unknown server activity (or attack?)
Posted on 2003-11-13
Go easy on me since I am a Web Programmer and not a Network or Server Engineer. :-)
I have a server running WIndows 2000 Server, IIS 5.0, Exchange 2000, SQL Server 2000, and Norton Corporate and Exchange Anti-virus. My Broadband connection goes through a Router that has basic blocking set-up but nothing specific. I only have 2 active e-mail addresses. I have 5 or 6 websites but they are mostly "Test" sites in which clients come and view progress on their Web Project. So, this server gets very little traffic.
I have been running this server for something like 2 years and never had a problem. Now, all of the sudden, starting yesterday morning, my server is working away. Hard Drive spinng and a constant noise. She is just working and working.
All of my internal apps and websites are very slow because the server is busy doing something else.
How do I find out what it is doing? Where do I even begin to look for a cause so that I can fix this. I have NO CLUE where to start.
Thanks in advance!