mysqld in Linux hacked

Check for crap in /var/lib/mysql like this


ls -al /var/lib/mysql/
total 20888
drwxr-xr-x 24 mysql mysql     4096 Oct  3 18:30 .
drwxr-xr-x 20 root  root      4096 Oct  3 04:23 ..

-rw-rw-rw-  1 mysql mysql    11776 Oct  3 17:10 c:\exp.exe
-rw-rw-rw-  1 mysql mysql    48128 Oct  3 17:10 c:\exp1.exe
-rw-rw-rw-  1 mysql mysql    55296 Oct  3 17:10 c:\exp2.exe
-rw-rw-rw-  1 mysql mysql    33812 Oct  3 17:10 c:\tan.exe
-rw-rw-rw-  1 mysql mysql    45056 Oct  3 17:10 c:\tan1.exe

This happened to a client who didn't firewall their port 3306 and had a weak root password.

Latest Articles

  • AMD Set Fan Speed and Other Powerplay Memory/CPU Timings with a Linux script
  • Ethereum Mining Claymore Nanopool Error
  • genisoimage errors with long filenames and deep directory structures
  • Linux Kernel USB Export Errors
  • How to download gajim 0.16.9 XMPP/Jabber client so you can use OMEMO encryption
  • HP DL385 G7 Linux BIOS Update Flash
  • hwloc-nox set CPU affinity in Linux
  • Firefox An error occurred during a connection to some-ip-or-domain. SSL peer reports incorrect Message Authentication Code. Error code: SSL_ERROR_BAD_MAC_ALERT Solution
  • Proxmox understanding the directory structure and why an NFS datastore appears to be missing files/isos
  • pandoc convert markdown to html
  • Proxmox error uploading an iso solution
  • Cannot install moodle
  • MySQL change for Antelope format to Barracuda error solution
  • vmkping -I vmk1 PING ( 56 data bytes sendto() failed (Host is down)
  • gvfs mount in /run/user cannot be accessed or displayed wrong permissions
  • VMWare vSphere 6.7 Errors Solution 503 Service Unavailable (Failed to connect to endpoint:
  • How To Enable Nested KVM so guests can virtualize with hardware extensions
  • vi error solution E166: Can't open linked file for writing
  • Supermicro IPMI / KVM / BMC Remote Console Screen Resizing Issue - Window Cut Off Solution
  • Linux bash shell doesn't show username, hostname or current path fix solution