New SQL Server 2000 worm?

Hi all.

My SQL Server 2000 SP4 installation running on Windows 2003 server (SP1, all patches current) has been infected TWICE by something that Sophos can't detect.

The symptoms are that an account called SQLsys is created on the machine and is made an administrator.

A service called "ApptoService spoolsrv" is created. An executable called syss.exe is also created in a few places. After infection the machine immediately starts attacking other computers on the network.

I had Windows Firewall running, with ports open for SQL server and Remote Desktop.

I ran the MBSA, it didn't find anything open.

I even ran the beta MS web tool for scanning, didn't detect any trojans.

I'm going to be restoring the machine (AGAIN), but I wish I knew what security hole is being found! Any ideas?
Please try changing your SA account password. Try a complicated password that has numbers, letters, and symbols in it. Also, do not allow your sql server to have inbound access to the internet. At the very least block port 1433 on your firewall.|||

Have you noticed this issue again after setting a strong SA password?

Thanks
Laurentiu

|||Try using Windows Defender beta which is a good one to catchup such trojans & spyware. Also check any spurious activity on SQL server by referring to data & log file usage with an audit trial.sql

New Processes after upgrade

Hi There

After upgrading to Sql Server 2005 Enterprise Edition , SP1.

if i run the following query:

select * from sysprocesses where waittime <> 0 order by waittime desc

I get the following result:

spid waittime lastwaittype status

10 4480 0 0x007E 78424187 ONDEMAND_TASK_QUEUE background
4 5620 0 0x009D 78418906 KSOURCE_WAKEUP background
16 4512 0 0x00A9 78418890 BROKER_TRANSMITTER background
17 4516 0 0x00A9 78418875 BROKER_TRANSMITTER background
12 5056 0 0x00AD 78418796 BROKER_EVENTHANDLER background
11 5728 0 0x0081 179140 CHECKPOINT_QUEUE background

Basscially the waittime just keeps going up infinitely for these processes, is this normal, should i be worried ?

Thanx

Have same issue with BROKER_EVENTHANDLER and BROKER_TRANSMITTER.

Normal behavior?

|||

Hi

This link from microsoft describes the various Wait Types (of which there a lot more in SQL Server 2005):

http://msdn2.microsoft.com/en-us/library/ms179984.aspx

Here is some information from it about your specific items.

ONDEMAND_TASK_QUEUE waits for high priority requests (and high wait times simply indicates there have been none of these.)

KSOURCE_WAKEUP waits for requests from the Service Control Manager and long waits are to be expected (pause then unpause the SQL Server service to cause this to reset).

CHECKPOINT_QUEUE - This is the Checkpoint task waiting for the next checkpoint request (few checkpoints = large wait - and that's only 3 minutes).

BROKER_* - These are associated with the service broker and whilst it does not specifically say, I suspect if you do not have service broker servicing requests then these just wait and wait.

If you are interested in monitoring blocking then you might like to read this knowledge base article:

http://support.microsoft.com/kb/271509 - (LiveID required)

This describes sp_blocker_pss80 - a stored procedure to monitor blocked processes in SQL server 2000 up (it does however still produce these system processes in it's list).

New line in column?

Is it possible?
Sp1 said:
New Lines in Expressions
Previously, expressions had to be contained on a single line. With
SP1, expressions can include a newline character. New line characters
include carriage return (CR), line feed (LF), carriage return and
line feed (CRLF), paragraph separator (Unicode 2029), and line
separator (Unicode 2028). The newline characters are replaced with a
space when the report is processed.
But I can't use it.
Please help me!
--
Composed with Newz Crawler 1.7 http://www.newzcrawler.com/Could you please post an example of how you're using it?
--
Ravi Mumulla (Microsoft)
SQL Server Reporting Services
This posting is provided "AS IS" with no warranties, and confers no rights.
"Sean.Xiao" <ydxiao@.suntowntech.com> wrote in message
news:ufUQ64dhEHA.1656@.TK2MSFTNGP09.phx.gbl...
> Is it possible?
> Sp1 said:
> New Lines in Expressions
> Previously, expressions had to be contained on a single line. With
> SP1, expressions can include a newline character. New line characters
> include carriage return (CR), line feed (LF), carriage return and
> line feed (CRLF), paragraph separator (Unicode 2029), and line
> separator (Unicode 2028). The newline characters are replaced with a
> space when the report is processed.
> But I can't use it.
> Please help me!
> --
> Composed with Newz Crawler 1.7 http://www.newzcrawler.com/|||These textbox expressions/values were entered using the expression editor.
The first item, in the examples, is the textbox expression/value while the
second is how it should render. Hopefully these will point you the right
direction for using VB constants in expressions.
Example 1
--
="The brown fox jumped" & vbcrlf & "over the fence
The brown fox jumped
over the fence
Example 2
--
The brown fox jumped
over the fence
The brown fox jumped
over the fence
Example 3
--
="The brown fox jumped" &
" over the fence"
The brown fox jumped over the fence
For more information about constants see Visual Basic Language Reference,
Print and Display Constants:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vblr7/html/vamscmiscellaneousconstants.asp
--
Bruce Johnson [MSFT]
Microsoft SQL Server Reporting Services
This posting is provided "AS IS" with no warranties, and confers no rights.
"Sean.Xiao" <ydxiao@.suntowntech.com> wrote in message
news:ufUQ64dhEHA.1656@.TK2MSFTNGP09.phx.gbl...
> Is it possible?
> Sp1 said:
> New Lines in Expressions
> Previously, expressions had to be contained on a single line. With
> SP1, expressions can include a newline character. New line characters
> include carriage return (CR), line feed (LF), carriage return and
> line feed (CRLF), paragraph separator (Unicode 2029), and line
> separator (Unicode 2028). The newline characters are replaced with a
> space when the report is processed.
> But I can't use it.
> Please help me!
> --
> Composed with Newz Crawler 1.7 http://www.newzcrawler.com/|||2004-08-20 00:32:50
"Bruce Johnson [MSFT]" <brucejoh@.online.microsoft.com> wrote in
message
<udj2toghEHA.556@.TK2MSFTNGP10.phx.gbl>
> These textbox expressions/values were entered using the expression
editor.
> The first item, in the examples, is the textbox expression/value
while the
> second is how it should render. Hopefully these will point you the
right
> direction for using VB constants in expressions.
>
> Example 1
> --
> ="The brown fox jumped" & vbcrlf & "over the fence
>
> The brown fox jumped
> over the fence
>
> Example 2
> --
> The brown fox jumped
> over the fence
>
> The brown fox jumped
> over the fence
>
> Example 3
> --
> ="The brown fox jumped" &
> " over the fence"
>
> The brown fox jumped over the fence
>
> For more information about constants see Visual Basic Language
Reference,
> Print and Display Constants:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-
us/vblr7/html/vamscmiscellaneousconstants.asp
>
> --
> Bruce Johnson [MSFT]
> Microsoft SQL Server Reporting Services
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
> "Sean.Xiao" <ydxiao@.suntowntech.com> wrote in message
> news:ufUQ64dhEHA.1656@.TK2MSFTNGP09.phx.gbl...
> > Is it possible?
> >
> > Sp1 said:
> >
> > New Lines in Expressions
> >
> > Previously, expressions had to be contained on a single line.
With
> > SP1, expressions can include a newline character. New line
characters
> > include carriage return (CR), line feed (LF), carriage return and
> > line feed (CRLF), paragraph separator (Unicode 2029), and line
> > separator (Unicode 2028). The newline characters are replaced
with a
> > space when the report is processed.
> >
> > But I can't use it.
> >
> > Please help me!
> > --
> > Composed with Newz Crawler 1.7 http://www.newzcrawler.com/
--
Composed with Newz Crawler 1.7 http://www.newzcrawler.com/|||Ok,Thanks Bruce.
--
Composed with Newz Crawler 1.7 http://www.newzcrawler.com/

New install of Windows 2003 EE sp1 and Sql Server 2000 sp3 full text problem

I have a newly installed Windows 2003 EE sp1 with Sql Server 2000 sp3
machine. I restored a database to the machine that had several full text
catalogs in it. I'm trying to go in and do a rebuild on the catalogs. When
I do this.. I get the error:
Error 7635: The Microsoft Search service cannot be administered under the
present user account.
The Sql Server Agent is being started with the system account.
I've tried this on a windows 2003 sp1 standardard machine with sql 2000 sp3.
I get the same error. It's making me belive that perhaps sp1 put some
security on that needs to be changed...
can someone help me get Full Text going agian.
Thanks
Shannon
Shannon,
Have you or anyone else removed or altered the login BUILTIN\Administrators
? If so, can you either re-establish it or reset the defaults back to master
database with sysadmin rights? If not (for security reasons), you may want
to implement the following T-SQL code as the external MSSearch service
(should be running under the system account) needs sysadmin rights when
accessing SQL Server:
exec sp_grantlogin N'NT Authority\System'
exec sp_defaultdb N'NT Authority\System', N'master'
exec sp_defaultlanguage N'NT Authority\System','us_english'
exec sp_addsrvrolemember N'NT Authority\System', sysadmin
Thanks,
John
SQL Full Text Search Blog
http://spaces.msn.com/members/jtkane/
"Shannon Ramirez" <dba@.prairieinet.net> wrote in message
news:u6kXJPaUFHA.1200@.TK2MSFTNGP10.phx.gbl...
> I have a newly installed Windows 2003 EE sp1 with Sql Server 2000 sp3
> machine. I restored a database to the machine that had several full text
> catalogs in it. I'm trying to go in and do a rebuild on the catalogs.
When
> I do this.. I get the error:
> Error 7635: The Microsoft Search service cannot be administered under the
> present user account.
> The Sql Server Agent is being started with the system account.
>
> I've tried this on a windows 2003 sp1 standardard machine with sql 2000
sp3.
> I get the same error. It's making me belive that perhaps sp1 put some
> security on that needs to be changed...
> can someone help me get Full Text going agian.
> Thanks
> Shannon
>
|||no.. i'm the database guy and I didn't alter it.
I've just doubled checked.. default db is master and it belongs to the
sysadmin role.
anything else you can think of that I shoudl check
"John Kane" <jt-kane@.comcast.net> wrote in message
news:O%23QYzjaUFHA.3176@.TK2MSFTNGP12.phx.gbl...
> Shannon,
> Have you or anyone else removed or altered the login
> BUILTIN\Administrators
> ? If so, can you either re-establish it or reset the defaults back to
> master
> database with sysadmin rights? If not (for security reasons), you may want
> to implement the following T-SQL code as the external MSSearch service
> (should be running under the system account) needs sysadmin rights when
> accessing SQL Server:
> exec sp_grantlogin N'NT Authority\System'
> exec sp_defaultdb N'NT Authority\System', N'master'
> exec sp_defaultlanguage N'NT Authority\System','us_english'
> exec sp_addsrvrolemember N'NT Authority\System', sysadmin
> Thanks,
> John
> --
> SQL Full Text Search Blog
> http://spaces.msn.com/members/jtkane/
>
> "Shannon Ramirez" <dba@.prairieinet.net> wrote in message
> news:u6kXJPaUFHA.1200@.TK2MSFTNGP10.phx.gbl...
> When
> sp3.
>
|||Shannon,
You should also confirm if the startup account for the SQL Server service
(MSSQLServer) has been altered via Win2K's Component applet vs. being
altered via SQL Server Enterprise manager. The later is the only place where
if one server is altered then both services security context is altered. See
the following two KB articles for more info:
317746 (Q317746) PRB: SQL Server Full-Text Search Does Not Populate Catalogs
http://support.microsoft.com/default...b;en-us;317746
277549 (Q277549) PRB: Unable to Build Full-Text Catalog After You Modify
MSSQLServer Logon Account Through [NT4.0) Control Panel [or Win2K Component
Services]
http://support.microsoft.com/default...B;EN-US;277549
Hope this helps!
John
SQL Full Text Search Blog
http://spaces.msn.com/members/jtkane/
"Shannon Ramirez" <dba@.prairieinet.net> wrote in message
news:u1WLC9aUFHA.2096@.TK2MSFTNGP14.phx.gbl...[vbcol=seagreen]
> no.. i'm the database guy and I didn't alter it.
> I've just doubled checked.. default db is master and it belongs to the
> sysadmin role.
> anything else you can think of that I shoudl check
> "John Kane" <jt-kane@.comcast.net> wrote in message
> news:O%23QYzjaUFHA.3176@.TK2MSFTNGP12.phx.gbl...
want[vbcol=seagreen]
text
>
|||thanks for the response.. I have checked and the accounts are as they should
be. this is already a production box so stopping and restarting the sql
service is not an option right now..
hope someone else has run into this and can help me out.
thanks
shannon
"John Kane" <jt-kane@.comcast.net> wrote in message
news:ex%23hQHbUFHA.3188@.TK2MSFTNGP09.phx.gbl...
> Shannon,
> You should also confirm if the startup account for the SQL Server service
> (MSSQLServer) has been altered via Win2K's Component applet vs. being
> altered via SQL Server Enterprise manager. The later is the only place
> where
> if one server is altered then both services security context is altered.
> See
> the following two KB articles for more info:
> 317746 (Q317746) PRB: SQL Server Full-Text Search Does Not Populate
> Catalogs
> http://support.microsoft.com/default...b;en-us;317746
> 277549 (Q277549) PRB: Unable to Build Full-Text Catalog After You Modify
> MSSQLServer Logon Account Through [NT4.0) Control Panel [or Win2K
> Component
> Services]
> http://support.microsoft.com/default...B;EN-US;277549
>
> Hope this helps!
> John
> --
> SQL Full Text Search Blog
> http://spaces.msn.com/members/jtkane/
>
> "Shannon Ramirez" <dba@.prairieinet.net> wrote in message
> news:u1WLC9aUFHA.2096@.TK2MSFTNGP14.phx.gbl...
> want
> text
>
|||I tried dropping the built in administrator sql account... then added it
back in along with the nt Authority\System account. On one of the windows
2003 sp1 sql 2000 sp3 boxes that fixed the problem. on the windows 2003 sp1
sql 2000 sp3 box.. it didn't. i'll restart teh sql service on Sunday and
see if that doesn't fix it.. sure hope so..
"Shannon Ramirez" <dba@.prairieinet.net> wrote in message
news:ePVuHUdUFHA.1384@.TK2MSFTNGP09.phx.gbl...
> thanks for the response.. I have checked and the accounts are as they
> should be. this is already a production box so stopping and restarting
> the sql service is not an option right now..
> hope someone else has run into this and can help me out.
> thanks
> shannon
> "John Kane" <jt-kane@.comcast.net> wrote in message
> news:ex%23hQHbUFHA.3188@.TK2MSFTNGP09.phx.gbl...
>

New error arithmetic overflow

Just recently I have been getting this error on several computers with
reports that were running fine. I will install RS SP1 but what is going on.
An error has occurred during report processing. (rsProcessingAborted) Get
Online Help
Cannot read the next data row for the data set ProductivityAvg.
(rsErrorReadingNextDataRow) Get Online Help
Arithmetic overflow error converting expression to data type datetimeI get the same error for a couple of users.
An error has occurred during report processing. (rsProcessingAborted)
Cannot read the next data row for the data set database_name.
(rsErrorReadingNextDataRow)
Arithmetic overflow error converting expression to data type datetime
Did you ever find the solution to this problem? All the users can access
these reports, except two. Cannot find the discrepancy.
If anyone knows the solution, please post.
thanks,
"Paul Strauss" wrote:
> Just recently I have been getting this error on several computers with
> reports that were running fine. I will install RS SP1 but what is going on.
> An error has occurred during report processing. (rsProcessingAborted) Get
> Online Help
> Cannot read the next data row for the data set ProductivityAvg.
> (rsErrorReadingNextDataRow) Get Online Help
> Arithmetic overflow error converting expression to data type datetime

New Data Connection Problem in VS.NET 2005

I have all of the prerequisites installed:

- SQL Server 2005 Compact Edition

- Visual Studio 2005 SP1 (Standard Edition)

- SQL Server Management Studio Express SP2

When trying to add a new Compact Edition SQL DB data connection from within Visual Studio ("SQL Mobile", "SQL Compact...", etc.), nothing is available for it. I have Access, ODBC, SQL Server, SQL DB File, Oracle, and Other. Even when selecting other, there are no Compact/Mobile types available.

Please Help...I've been going crazy trying to get this option.

Thank you

Anybody? Anybody at all?|||

I guess you'll have to settle for me.

I too have had problems installing the lastest SP of Visual Studio (VS) which includes the latest SQL Server Compact Edition (SQLCe) binaries. The problem is that you must make sure that if you've installed any CTPs they must be scrubbed off first. So, assuming you've done that or never installed the beta CTPs (which were used to implement SQL Server Everywhere Edition), you need to first install VS 2005 SP1 from http://msdn2.microsoft.com/en-us/vstudio/bb265237.aspx. Next, you might also need to install the SQLCe MSI to get the bit installed in the GAC. These bits can be found here http://www.microsoft.com/sql/editions/compact/downloads.mspx. As shown in my EBook "Hitchhiker's Guide to SQL Server 2005 Compact Edition", you can also download the SDK but you should now see the SQL Server Compact Edition as one of the choices when creating a Data Connection.

hth

|||APipeDream

I am having the same problem - did you get anywhere with it ?
|||

No, that's the order I used already, and I don't have any CTPs installed. I also have the SDK installed.

|||

So am I.

I uninstalled/re-installed all componenets still no luck.

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Gotta create a DDEX Provider?

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1477140&SiteID=1

|||

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Thanks This worked:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

New Data Connection Problem in VS.NET 2005

I have all of the prerequisites installed:

- SQL Server 2005 Compact Edition

- Visual Studio 2005 SP1 (Standard Edition)

- SQL Server Management Studio Express SP2

When trying to add a new Compact Edition SQL DB data connection from within Visual Studio ("SQL Mobile", "SQL Compact...", etc.), nothing is available for it. I have Access, ODBC, SQL Server, SQL DB File, Oracle, and Other. Even when selecting other, there are no Compact/Mobile types available.

Please Help...I've been going crazy trying to get this option.

Thank you

Anybody? Anybody at all?|||

I guess you'll have to settle for me.

I too have had problems installing the lastest SP of Visual Studio (VS) which includes the latest SQL Server Compact Edition (SQLCe) binaries. The problem is that you must make sure that if you've installed any CTPs they must be scrubbed off first. So, assuming you've done that or never installed the beta CTPs (which were used to implement SQL Server Everywhere Edition), you need to first install VS 2005 SP1 from http://msdn2.microsoft.com/en-us/vstudio/bb265237.aspx. Next, you might also need to install the SQLCe MSI to get the bit installed in the GAC. These bits can be found here http://www.microsoft.com/sql/editions/compact/downloads.mspx. As shown in my EBook "Hitchhiker's Guide to SQL Server 2005 Compact Edition", you can also download the SDK but you should now see the SQL Server Compact Edition as one of the choices when creating a Data Connection.

hth

|||APipeDream

I am having the same problem - did you get anywhere with it ?
|||

No, that's the order I used already, and I don't have any CTPs installed. I also have the SDK installed.

|||

So am I.

I uninstalled/re-installed all componenets still no luck.

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Gotta create a DDEX Provider?

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1477140&SiteID=1

|||

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Thanks This worked:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

New Data Connection Problem in VS.NET 2005

I have all of the prerequisites installed:

- SQL Server 2005 Compact Edition

- Visual Studio 2005 SP1 (Standard Edition)

- SQL Server Management Studio Express SP2

When trying to add a new Compact Edition SQL DB data connection from within Visual Studio ("SQL Mobile", "SQL Compact...", etc.), nothing is available for it. I have Access, ODBC, SQL Server, SQL DB File, Oracle, and Other. Even when selecting other, there are no Compact/Mobile types available.

Please Help...I've been going crazy trying to get this option.

Thank you

Anybody? Anybody at all?|||

I guess you'll have to settle for me.

I too have had problems installing the lastest SP of Visual Studio (VS) which includes the latest SQL Server Compact Edition (SQLCe) binaries. The problem is that you must make sure that if you've installed any CTPs they must be scrubbed off first. So, assuming you've done that or never installed the beta CTPs (which were used to implement SQL Server Everywhere Edition), you need to first install VS 2005 SP1 from http://msdn2.microsoft.com/en-us/vstudio/bb265237.aspx. Next, you might also need to install the SQLCe MSI to get the bit installed in the GAC. These bits can be found here http://www.microsoft.com/sql/editions/compact/downloads.mspx. As shown in my EBook "Hitchhiker's Guide to SQL Server 2005 Compact Edition", you can also download the SDK but you should now see the SQL Server Compact Edition as one of the choices when creating a Data Connection.

hth

|||APipeDream

I am having the same problem - did you get anywhere with it ?
|||

No, that's the order I used already, and I don't have any CTPs installed. I also have the SDK installed.

|||

So am I.

I uninstalled/re-installed all componenets still no luck.

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Gotta create a DDEX Provider?

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1477140&SiteID=1

|||

I found a solution:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.

|||

Thanks This worked:

I re-installed the following off the original install DVD - sqlmobile30devtoolsenu.msi, then installed the update SSCE31VSTools-ENU.exe which can be downloaded from Microsoft.