it would not be the first time a hotfix has reintroduced a problem fixed by an earlier hotfix.

you do want to be at least at SP4 so If I was you I would apply the level that works for you (SP4 plus hotfix to 2148) and leave it at that. It leaves you at very near the highest level you can go to on SQL 2000. I would also turn off WSUS on your SQL servers, you need more control over patches that are applied to SQL.

The security hotfix MS08-040 is 'important' rather than 'critical' so if your server is behind a firewall and not open to the world you should be ok. As this is a known bug I would also report it to MS, there should be no charge.

If you can work up a code workaround I would for future proofing. Seems strange that an app adds or drops an alias?

Good luck and thanks, that was fun. 🙂