You should disable the xp_cmdshell unless absolutely needed:
http://www.sqlservercentral.com/Forums/Topic828767-386-1.aspx
http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=123821
http://blogs.msdn.com/sqlsecurity/archive/2008/01/10/xp-cmdshell.aspx
Respectfully,
Welsh
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/