[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: HELP SOS



Hereward Cooper wrote:



Talking about being locked out of mysql, the other day I found my machine doing
very strange things at things at 6:30am very morning. It started by my root
password being changed (from nothing), after which I just reinstalled. Next the
grant tables got screwed up by something and I was locked out of very db on the
server. I backed up the important db's and reinstalled, every thing seemed to
work. The next day the exact same thing happened, at the same time.
The mysql.log files listed php-nuke trying to do stuff even when it wasn't being
used or hadn't been in many days. I blew away php-nuke, which I wasn't using
anyhow and everything seems to be back to norm.
Anyone know why this might happen? Anyone had this problem?

Thanks,

Hereward






php-nuke has a big security hole in it.. you can read up more on it on:

http://lwn.net/2001/1115/security.php3

Your server sounds compromised, I'd look deep into files or better take a copy of anything important and reinstall from scratch.

/Roger



Reply to: