xp_cmdshell missing

[Jim]

We have a series of stored procedures that utilize some of the master
extended SPs such as xp_cmdshell. We migrated to SQL 2000 in April and
everything has worked great for over 3 months. However, this week we
discovered that the xp_cmdshell SP was missing from the master
database. Here is the error we received:

Server: Msg 2812, Level 16, State 62, Line 1
Could not find stored procedure 'master..xp_cmd shell'.

We reinstalled the SP from a previous instance so we are back up and
running. What would cause the SP to all of a sudden vanish? I believe
we have the SQL SP 3a patch installed. Although we have scanned the
server for worms and viruses, should we be looking in a particular log
for something malicious on the server? If it is not an attack of some
type, would there be another explanation for this? One other thing
worth noting - a few weeks ago we could not utilize our system
administrator account on SQL. In order to use the account again we had
to reset the password. Could these events be related and what could be
a likely cause? For obvious reasons we are concerned and would
appreciate any information anyone might have.


Thanks!
Jim

[Erland Sommarskog]

Re: xp_cmdshell missing

Jim (jromano@phs-us.com) writes:[color=blue]
> We have a series of stored procedures that utilize some of the master
> extended SPs such as xp_cmdshell. We migrated to SQL 2000 in April and
> everything has worked great for over 3 months. However, this week we
> discovered that the xp_cmdshell SP was missing from the master
> database. Here is the error we received:
>
> Server: Msg 2812, Level 16, State 62, Line 1
> Could not find stored procedure 'master..xp_cmd shell'.
>
> We reinstalled the SP from a previous instance so we are back up and
> running. What would cause the SP to all of a sudden vanish? I believe
> we have the SQL SP 3a patch installed. Although we have scanned the
> server for worms and viruses, should we be looking in a particular log
> for something malicious on the server? If it is not an attack of some
> type, would there be another explanation for this? One other thing
> worth noting - a few weeks ago we could not utilize our system
> administrator account on SQL. In order to use the account again we had
> to reset the password. Could these events be related and what could be
> a likely cause? For obvious reasons we are concerned and would
> appreciate any information anyone might have.[/color]

I have never heard of anything like this. Undoubtedly, it seems like
you have been victim of an intruder - or someone on the inside with
malicious intentions.


--
Erland Sommarskog, SQL Server MVP, esquel@sommarsk og.se

Books Online for SQL Server SP3 at

http://www.microsoft.com/sql/techinfo/productdoc/2000/books.asp