Need Help Stopping a Rouge Extended Procedure (XPSMTP)

  • I'm experiencing a very unusual problem with one of our old SQL 2000 installs. Backstory: we've used xpsmtp80.dll on all of our SQL 2000 SQL Agent jobs in the past, with much success. If certain steps in a job ever fail, the agent jumps to a step in the job which uses xp_smtp_sendmail to notify the proper individuals. On one of our remaining SQL 2000 systems, we started receving email alerts that the tlog backup job failed, although there was no failure anywhere in the job. Fast forward a couple weeks, and we have completely deleted the job in question, deleted the extended procedure from SQL, deleted the .dll from the file system, and rebooted the sever. We are still getting these emails exactly when the old job used to run (we do have a new tlog back job that runs at slightly different times and does not use xp_smtp_sendmail).

    Has anyone seen anything like this before? Is there something in the msdb db that needs to be cleaned up? I'm not sure where to go from here. Thanks in advance.

  • No progress on this issue yet, but a couple more pieces of information: I have checked the msdb sysjobs and sysjobschedules tables for suspect entries, but there's nothing unusual there. Additionally, I stopped the agent job a few minutes before the phantom task was scheduled to run, but I still got an email at the scheduled time. So, whatever is happening is happening without the agent.

  • Have you checked to see if there are any tasks running under the Windows Task Manager?

  • I figured out what had happened here. It turns out someone had cloned the SQL sever without my knowledege and that new server was the one sending the emails. The syntax of messages between the two servers was identical which is why I thought it was coming from the orginal.

    Thanks for your input, Lynn.

  • qgudex (5/1/2013)


    I figured out what had happened here. It turns out someone had cloned the SQL sever without my knowledege and that new server was the one sending the emails. The syntax of messages between the two servers was identical which is why I thought it was coming from the orginal.

    Thanks for your input, Lynn.

    Yikes! Perhaps Skynet is becoming self-aware and resisting efforts to diminish its existing functionality?

    Jason Wolfkill

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply