Been there too. Sounds like a 'script kiddy'.
You should check your hosts.allow/deny, then firewall software configuration (ipchains?) files. That MIGHT get you into a functional situation. Also, programs like 'ls', ps, netstat ,etc have been replaced on your system, and you won't be able to delete then without special file control knowledge. Plan on spending a bunch of time or simply rebuilding the server. Check your root directory and the password file. Fastest way to a working server is to build a new one and patch it in, until you get the others working. Good luck, Kevin [EMAIL PROTECTED] wrote: >Hi > >We have 2 Redhat 6.1 servers and MySQL 3.22.32 and both boxes >appear to have been hacked on Friday last and MYSQL client just hangs >when connecting to the localhost MYSQL server. > >MySQL is running on both boxes and suffer the same problems. > >We also have to use kill -9 pid number to kill the server(s). > >No MySQL client can connect remotely to either of these machines however the >local MySQL client on the hacked server(s) can connect to other remote MySQL >servers. > >We have re-installed MySQL server on this hacked server and still the client >just hangs and no >errors in the logs appear. > >We have Intrusion software but its very long winded trying to find how to >fix it - and ultimately we will re-install. >(but first I have 600 clients per server to please!) > >Please HELP we and all our tech guys are stumped. > >Any more info please ask. > >Kind regards > >Tony > > > > > > >--------------------------------------------------------------------- >Before posting, please check: > http://www.mysql.com/manual.php (the manual) > http://lists.mysql.com/ (the list archive) > >To request this thread, e-mail <[EMAIL PROTECTED]> >To unsubscribe, e-mail ><[EMAIL PROTECTED]> >Trouble unsubscribing? Try: http://lists.mysql.com/php/unsubscribe.php > --------------------------------------------------------------------- Before posting, please check: http://www.mysql.com/manual.php (the manual) http://lists.mysql.com/ (the list archive) To request this thread, e-mail <[EMAIL PROTECTED]> To unsubscribe, e-mail <[EMAIL PROTECTED]> Trouble unsubscribing? Try: http://lists.mysql.com/php/unsubscribe.php
