sp_addextendedproc

[johndweidauer]

I was hit with some spyware/malware/trojans. one of these executed procedures on sql server 2000 sp4 that drop xp_cmdshell. i cleaned the servers, or so i thought, and also created a little job that would run every 5 mins to verify that xp_cmdshell still exists, recreate if not using sp_addextendedproc.

now i am faced with the fact that sp_addextendedproc no longer exists and I cannot figure out how to recreate it. I am planning on rebuilding this server this weekend, but anyone help me for the next couple of days with a bandaid solution?

 

[SQLDenis]

example 5 might help you

http://www.owasp.org/index.php/Testing_for_SQL_Server

Denis The SQL Menace
--------------------
SQL Server Code,Tips and Tricks, Performance Tuning
SQL Server Programming Hacks

 

[johndweidauer]

Example 5 deals with the adding of the xp_cmdshell extended proc. This I have done, but now the sp_addextendedproc is missing, sp_addextendedproc is used to add the extended proc xp_cmdshell.

 

[SQLDenis]

Use this as a workaround for now

Denis The SQL Menace
--------------------
SQL Server Code,Tips and Tricks, Performance Tuning
SQL Server Programming Hacks

 

[johndweidauer]

gotcha

 

[johndweidauer]

I didn't realize that these other two procedures were affected the same way:

sp_OACreate
sp_OAMethod

both of which are required prior to following Exapmle 5:

SQL RESULTS

Cannot add rows to sysdepends for the current stored procedure because it depends on the missing object 'sp_OACreate'. The stored procedure will still be created.

Cannot add rows to sysdepends for the current stored procedure because it depends on the missing object 'sp_OAMethod'. The stored procedure will still be created.
-------------------------------------------
I try to execute this line:
exec master..xp_cmdshell 'ftp.exe -s:C:\ftp.txt'

and it will error out due to the missing sp_OAMethod

can these sp be created manually?