How to solve error 18456 SQL Server + 1C?

Question

1C

Hello.
There is a problem with sheaf 1C+MSSQL. The sa user is permanently blocked, changing the password helps. That's what my colleagues told me. Today I went into the SQL logs and noticed that constantly (every 2-5 seconds 3-5 times) someone is knocking from the localhost under the sa user and the wrong password. error 18456, severity 14, state 8. It was logical to think that the problem of blocking sa lies precisely in this.
But honestly, my knowledge is not enough to find the culprit who is constantly knocking on sql. Tell me what it can be, how it is possible to solve it and are these two facts connected at all?

Answer 1

Did you think it was a trojan? Another option is that there is software locally that is incorrectly configured (during installation, it saw the presence of MsSQL and offered to store logs there, but did not guess the password and now bombs all the time).
If you yourself cannot "calculate" the culprit by viewing the list of running processes, then use a program that shows the sockets being opened - see which process "every 2-5 seconds 3-5 times" opens a connection to port 1433 or 1434.