Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Somehow sqlservr.exe launches cmd.exe (with very strange command line params) and ftp.exe processes on my PC, please see screenshots. I have already installed antivirus. What it could be, how to treat or fix that? Thanks

enter image description here

enter image description here

share|improve this question

migrated from Nov 22 '11 at 22:40

This question came from our site for system and network administrators.

up vote 13 down vote accepted

That tends to look like you've been compromised ("pwn3d"). That's pretty suspicious activity. I'd get that box off the 'net as quickly as you can, start investigating how the breach might have occurred, and be ready to restore the machine from backup if something persistent has been installed on the box.

There may not be anything persistent installed on your machine (yet). I tend to think there isn't.

It's likely that you've got xp_cmdshell enabled in your SQL Server instance and a remote attacker is using that functionality in an attempt to bring down code and execute it on your box. Based on the fact that cmd.exe is being spawned from sqlservr.exe this seems likely.

If you know you don't need the xp_cmdshell functionality enabled for any application you're hosting I'd go ahead and disable it (those instructions discuss enabling it, but disabling it can be done with the same process using "0" to disable instead of "1" to enable).

It looks like you might be blocking outbound FTP from the server (bravo!) and that's likely preventing the attacker from bringing down their code and running it.

SQL Profiler can show you the queries the attacker is running to cause the xp_cmdshell to be run. Presumably they're injecting SQL into an application that's using SQL Server.

share|improve this answer
I concur. Those command-lines are pulling executable content from Out There for local execution. – SysAdmin1138 Nov 22 '11 at 22:14
The anti-malware program should have reported one of the seemingly many minor variants on the Trojan-Downloader:BAT.FTP theme. – JdeBP Nov 22 '11 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .