I need to disable xp_cmdshell in SQL Express Edition 2005. I thought it was disabled because I don't have the option to enable it "checked" on. That is the only setting I see (one check box to enable xp_cmdshell) within SQL Server 2005 Surface Area Configuration (for features).

Only information I can find for xp_cmdshell if for SQL 2000, none of the command prompt commands work.
I have also tried removing the xplog70.dll file, since I read that is supposeably the associated DLL file for xp_cmdshell, but my vulnerability scanner still reports a finding.

I'm not to handy with SQL; I guess I don't have a lot of the features because it is SQL Express (the free version).

Here is what the finding TELLS me to do...
Disable the XP_CMDSHELL procedure using the sp_dropprocedure store procedure or REMOVE the associated loading .DLL from SQL's loaded library.

I guess my questions are this...
What are all the associated files with xp_cmdshell (SQL 2005 only please)?
How do I  utilize sp_dropprocedure within SQL 2005 Express?
How do I permanently disable this without disrupting other aspects of SQL?
Found this script that HELPS secure SQL
Run it from the SQL command prompt (SQLCMD.EXE)

-------------------
use master
exec sp_dropextendedproc 'xp_cmdshell'
exec sp_dropextendedproc 'xp_enumgroups'
exec sp_dropextendedproc 'xp_loginconfig'
exec sp_dropextendedproc 'xp_enumerrorlogs'
exec sp_dropextendedproc 'xp_getfiledetails'
exec sp_dropextendedproc 'Sp_OACreate'
exec sp_dropextendedproc 'Sp_OADestroy'
exec sp_dropextendedproc 'Sp_OAGetErrorInfo'
exec sp_dropextendedproc 'Sp_OAGetProperty'
exec sp_dropextendedproc 'Sp_OAMethod'
exec sp_dropextendedproc 'Sp_OASetProperty'
exec sp_dropextendedproc 'Sp_OAStop'
exec sp_dropextendedproc 'xp_regaddmultistring'
exec sp_dropextendedproc 'xp_regdeletekey'
exec sp_dropextendedproc 'xp_regdeletevalue'
exec sp_dropextendedproc 'xp_regenumvalues'
exec sp_dropextendedproc 'xp_regremovemultistring'
exec sp_dropextendedproc 'xp_regwrite'
drop procedure sp_makewebtask
GO
---------------------

I actually didn't run the use master command...you can run these commands one at a time or all together, ex. below....
1>exec sp_dropextendedproc 'xp_cmdshell'
2>exec sp_dropextendedproc 'xp_loginconfig'
3>go

That simple, just a PAIN to find out if your not a SQL freak.
LINKS I USED...
http://www.treeratfishing.com/2008/01/25/sql-security-disable-sql-xp_cmdshell/
http://blogs.somerandomcompany.com/epitti/2009/07/undo-sql-2000-hardening-by-restoring.html