> have you checked task manager processes? I've seen this on a machine

where a

> malicious script is cycle starting sockets
> Alan
>

I will check this. It is a pretty tightly controlled environment, our
users don't have file system access to explorer, taskmgr, iexplore,
cmd, regedit, mmc and all the other fun toys they may otherwise have.
Also, since restarting the firebird process there is no issue (and
there are a lot more users now than over the weekend) so I would expect
such a malicious script to still be giving us grief. Also, terminal
services itself was still functioning correctly so I do not think the
system ran out of sockets.

If it ever happens again (hopefully not), I will make sure support
checks the threadcount etc before restarting the service.

Adam