Is it a virus on my PC?

Question

Somehow sqlservr.exe launches cmd.exe (with very strange command line params) and ftp.exe processes on my PC, please see screenshots. I have already installed antivirus. What it could be, how to treat or fix that? Thanks

Answer 1

That tends to look like you've been compromised ("pwn3d"). That's pretty suspicious activity. I'd get that box off the 'net as quickly as you can, start investigating how the breach might have occurred, and be ready to restore the machine from backup if something persistent has been installed on the box.

There may not be anything persistent installed on your machine (yet). I tend to think there isn't.

It's likely that you've got xp_cmdshell enabled in your SQL Server instance and a remote attacker is using that functionality in an attempt to bring down code and execute it on your box. Based on the fact that cmd.exe is being spawned from sqlservr.exe this seems likely.

If you know you don't need the xp_cmdshell functionality enabled for any application you're hosting I'd go ahead and disable it (those instructions discuss enabling it, but disabling it can be done with the same process using "0" to disable instead of "1" to enable).

It looks like you might be blocking outbound FTP from the server (bravo!) and that's likely preventing the attacker from bringing down their code and running it.

SQL Profiler can show you the queries the attacker is running to cause the xp_cmdshell to be run. Presumably they're injecting SQL into an application that's using SQL Server.