SQL Server 2008R2 Agent Malware

Question

List of unidentified sql jobs

Our SQL Server 2008 R2 has lots of auto generated jobs from nowhere as can be seen from image above. I strongly suspect this causes our server password keeps reset daily for no reasons (I had untick those 'Enforce password policy' checkboxes). For now I had delete the jobs but I am not sure can this really solve the root of the problems. Any idea on this? Thanks guys...

Answer 1

Your server has most likely been compromised. The most appropriate thing to do in this situation is to either reinstall everything from scratch and restore your last known good data backup (prior to getting compromised), or perform a bare metal restore of the server from the last known good (uncompromised) backup. At this point you don't know what malicious software is still on that server, so you have to assume that it's riddled with it.

Do this after you've ensured that the server will be secured from network attacks and don't leave it exposed to the public internet. If it wasn't previously exposed, you may have malicious software on your company network.