Hi. I have a Windows 2003 MSSQL server and I found the sqlck.exe hack script running. I have also found rtgen.exe running. I am wondering if this is a direct exploit, a worm that caused it to be installed, or if the server was fully compromised. I think there is a possibility that the server has been fully compromised, but what does not make sense is if it was compromised then there does not seem to be much reason to run sqlck.exe or rtgen.exe (unless they are targetting other servers). Has anyone ever seen this on a non-compromised server?
