Check whether the MSSQL Stored Procedure is tampered

Use master

 
Go
 
-- Check whether xp_mongoshell is tampered
 
Select * from master .. syscomments where object_name (id) = xp_mongoshell and text <> xplog70.dll
 
Go
 
-- Check whether other stored procedures are tampered
 
Select object_name (id), * from master .. syscomments where object_name (id) in
 
 
(Xp_getfiledetails, xp_availablemedia, xp_dirtree, xp_fixeddrives, xp_s
Ubdirs,
Xp_fileexist, xp_get_tape_devices, sp_MSgetversion, xp_enumdsn, xp_regr
Ead, xp_regwrite, xp_regdeletevalue,
Xp_regaddmultistring, xp_regremovemultistring, xp_regenumkeys, xp_regenu
Mvalues, xp_regdeletekey, xp_instance_regread,
Xp_instance_regwrite, xp_instance_regdeletevalue, xp_instance_regaddmulti
String, xp_instance_regremovemultistring,
Xp_instance_regenumkeys, xp_instance_regenumvalues) and text <> Nxpstar. dll
Go
-- If xp_mongoshell is tampered, execute the following statement to change it back.
Drop procedure xp_cmdshell
Go
Exec sp_addextendedproc Nxp_cmdshell, Nxplog70.dll
Go
-- Then run the following statement to verify that xp_cmdshell is correct.
-- Xp_cmdshell dir c: