Hi,
Our SQL Server become very slow. While trying to figure it out where is the problem I noticed strange TCP connections on Resource Monitor. While nobody from outside our LAN is connected to our server I see many connections from (or to) these remote addresses:
45.227.255.152, 194.61.24.95, 185.156.177.235, 193.188.22.13
All of them are related to svchosts.exe(termsvcs), local port is 3389, remote ports are high. All those connections are greyed out. Is it OK? What all those connections means? Does anybody trying to attack our server?
I have checked server for viruses but found nothing.