Look in the memory
You can use the Windows Task Manager to search for applications that don't seem to belong or those using up serious memory or processor time. I recommend using Sysinternals' Process Explorer (shown below highlighting the NetBus Trojan) since it provides more information on running processes as well as a more reliable way to kill processes that don't belong.
Sysinternals' Process Explorer shows details about all processes – including Trojans
You're probably thinking this seems like too much effort – how could you possibly keep up with what's loaded on your Windows server. It's not too much when you think about it; Of all the systems on your network, you really need to know your database server inside and out – which includes documenting which processes are supposed to be running and which aren't. So, if you get a good baseline after a fresh install -- or even now, assuming things are running well – you can use that as your basis for comparison when troubleshooting Trojan-type issues down the road.
Test for a Trojan horse on your SQL Server
Home: Introduction
Step 1: Scan your SQL Server for malware
Step 2: Look in the memory
Step 3: Look at open ports
Step 4: Peek into your network traffic
Step 5: Approach with a malicious mindset
