i just found a pc with a instances of mssql running on it named backoffice1. when i do a netstat it shows it connected to a public ip that belongs China Unicom according to the whois site. I am guessing its reload time but I want to learn from this. What can i do to see what is really going on or more about tracking down where it came from.