I have set up a new 2003 server r 2, with terminal sevices, Sql server and Citrix presentnation server 4.5. My problem is that an IP address (from a Canadian regiser) keeps attempting to log unto the SQL. This occurs at restart, but even after a clean restart (with my card disabled), the IP address eventually shows back up. What brought me to find this was "failed" login attempts in the event viewer and netstat -aon confirms that the unwanted address is attached and listening. Even behind a fire appliance and change of my static IP address, the unwanted attached IP address shows back up. Any thoughts or ideas?

Sounds like one of the sql exploits. This was patched some time ago. Are you uptodate on your patches for both server and sql? Google sql exploit for more info. It also maybe that you have been hacked. Imagine the power if you knew how to internet search

Thanks, I check the updates. I thought I had the system to to date, but I assumed that would have included sql.