The remote host closed the connection. The error code is 0x800704CD

I seem to recall that this error can occur if you click a button/link etc before the page has fully loaded.

If this is the case, the error is caused by an ASP.net 2.0 feature called Event Validation. This is a security feature that ensures that postback actions only come from events allowed and created by the server to help prevent spoofed postbacks. This feature is implemented by having controls register valid events when they render (as in, during their actual Render() methods). The end result is that at the bottom of your rendered form tag, you'll see something like this:

<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION"  value="AEBnx7v.........tS" />

When a postback occurs, ASP.net uses the values stored in this hidden field to ensure that the button you clicked invokes a valid event. If it's not valid, you get the exception that you've been seeing.

The problem you're seeing happens specifically when you postback before the EventValidation field has been rendered. If EventValidation is enabled (which it is, by default), but ASP.net doesn't see the hidden field when you postback, you also get the exception. If you submit a form before it has been entirely rendered, then chances are the EventValidation field has not yet been rendered, and thus ASP.net cannot validate your click.

One work around is of course to just disable event validation, but you have to be aware of the security implications. Alternatively, just never post back before the form has finished rendering. Of course, that's hard to tell your users, but perhaps you could disable the UI until the form has rendered?

from http://forums.asp.net/p/955145/1173230.aspx

Would the best way to detect this be to simply do a string search for phrases like "varchar" and "sysobjects"?

Not if you're going to immediately throw an exception when you see them... then you'd be breaking your application if the user decided they wanted to eg. search your site for information about varchars.

If your application is properly written, “XSS protection” hacks like this provide nothing except these occasional breakages. If your application isn't properly written, the ‘protection’ is at best an ineffective obfuscation.

You could certainly log requests that look like they might be attacks so you can go through and review attacker IPs later. Unfortunately this tends not to be as much use as you might think, as so many of the attack scripts are running on networks of compromised servers and botnet trojans, with a huge selection of IP addresses to choose from.