It may be possible to us SQL Server's
syscacheobjects view to retrieve the currently
running queries. However, this view is primarily a cache,
which means that multiple different queries may map onto
the same cached object. In this specific case, it seems
that similar queries with different WHERE clauses don't add
new entries to the cache. As a result of this, we have been
unable to create a virus using this functionality.
As of the 2005 version, SQL Server provides the
sys.dm_exec_sql_text view, which seems to
offer the ability to retrieve the currently running query.
However, we have been unable to test this.