SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Need Help Stopping a Rouge Extended Procedure (XPSMTP)


Need Help Stopping a Rouge Extended Procedure (XPSMTP)

Author
Message
qgudex
qgudex
Grasshopper
Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)

Group: General Forum Members
Points: 10 Visits: 32
I'm experiencing a very unusual problem with one of our old SQL 2000 installs. Backstory: we've used xpsmtp80.dll on all of our SQL 2000 SQL Agent jobs in the past, with much success. If certain steps in a job ever fail, the agent jumps to a step in the job which uses xp_smtp_sendmail to notify the proper individuals. On one of our remaining SQL 2000 systems, we started receving email alerts that the tlog backup job failed, although there was no failure anywhere in the job. Fast forward a couple weeks, and we have completely deleted the job in question, deleted the extended procedure from SQL, deleted the .dll from the file system, and rebooted the sever. We are still getting these emails exactly when the old job used to run (we do have a new tlog back job that runs at slightly different times and does not use xp_smtp_sendmail).

Has anyone seen anything like this before? Is there something in the msdb db that needs to be cleaned up? I'm not sure where to go from here. Thanks in advance.
qgudex
qgudex
Grasshopper
Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)

Group: General Forum Members
Points: 10 Visits: 32
No progress on this issue yet, but a couple more pieces of information: I have checked the msdb sysjobs and sysjobschedules tables for suspect entries, but there's nothing unusual there. Additionally, I stopped the agent job a few minutes before the phantom task was scheduled to run, but I still got an email at the scheduled time. So, whatever is happening is happening without the agent.
Lynn Pettis
Lynn Pettis
SSC-Dedicated
SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)SSC-Dedicated (39K reputation)

Group: General Forum Members
Points: 39117 Visits: 38518
Have you checked to see if there are any tasks running under the Windows Task Manager?

Cool
Lynn Pettis

For better assistance in answering your questions, click here
For tips to get better help with Performance Problems, click here
For Running Totals and its variations, click here or when working with partitioned tables
For more about Tally Tables, click here
For more about Cross Tabs and Pivots, click here and here
Managing Transaction Logs

SQL Musings from the Desert Fountain Valley SQL (My Mirror Blog)
qgudex
qgudex
Grasshopper
Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)Grasshopper (10 reputation)

Group: General Forum Members
Points: 10 Visits: 32
I figured out what had happened here. It turns out someone had cloned the SQL sever without my knowledege and that new server was the one sending the emails. The syntax of messages between the two servers was identical which is why I thought it was coming from the orginal.

Thanks for your input, Lynn.
wolfkillj
wolfkillj
UDP Broadcaster
UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)UDP Broadcaster (1.5K reputation)

Group: General Forum Members
Points: 1454 Visits: 2582
qgudex (5/1/2013)
I figured out what had happened here. It turns out someone had cloned the SQL sever without my knowledege and that new server was the one sending the emails. The syntax of messages between the two servers was identical which is why I thought it was coming from the orginal.

Thanks for your input, Lynn.


Yikes! Perhaps Skynet is becoming self-aware and resisting efforts to diminish its existing functionality?

Jason Wolfkill
Blog: SQLSouth
Twitter: @SQLSouth
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search