2

Somehow sqlservr.exe launches cmd.exe (with very strange command line params) and ftp.exe processes on my PC, please see screenshots. I have already installed antivirus. What it could be, how to treat or fix that? Thanks

enter image description here

enter image description here

1 Answer 1

13

That tends to look like you've been compromised ("pwn3d"). That's pretty suspicious activity. I'd get that box off the 'net as quickly as you can, start investigating how the breach might have occurred, and be ready to restore the machine from backup if something persistent has been installed on the box.

There may not be anything persistent installed on your machine (yet). I tend to think there isn't.

It's likely that you've got xp_cmdshell enabled in your SQL Server instance and a remote attacker is using that functionality in an attempt to bring down code and execute it on your box. Based on the fact that cmd.exe is being spawned from sqlservr.exe this seems likely.

If you know you don't need the xp_cmdshell functionality enabled for any application you're hosting I'd go ahead and disable it (those instructions discuss enabling it, but disabling it can be done with the same process using "0" to disable instead of "1" to enable).

It looks like you might be blocking outbound FTP from the server (bravo!) and that's likely preventing the attacker from bringing down their code and running it.

SQL Profiler can show you the queries the attacker is running to cause the xp_cmdshell to be run. Presumably they're injecting SQL into an application that's using SQL Server.

2
  • I concur. Those command-lines are pulling executable content from Out There for local execution. Nov 22, 2011 at 22:14
  • The anti-malware program should have reported one of the seemingly many minor variants on the Trojan-Downloader:BAT.FTP theme.
    – JdeBP
    Nov 22, 2011 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .