Re: [us...@httpd] Someone hacked my apache2 server

2010-04-05 Thread Oleg Goryunov
r > > LSN: Not Relevant > User Filed as: Not a Record > > Oh, ok. I got it. I have already disabled it (actually, immediately after > the attack). > Thanks for the advice. I appreciate! > Oleg. > > On Sun, Apr 4, 2010 at 5:52 PM, Daniel Reinhardt <*crypto...@cryptodan

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-04 Thread Oleg Goryunov
Oh, ok. I got it. I have already disabled it (actually, immediately after the attack). Thanks for the advice. I appreciate! Oleg. On Sun, Apr 4, 2010 at 5:52 PM, Daniel Reinhardt wrote: > > -- > From: "Oleg Goryunov" > Sent

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-04 Thread Oleg Goryunov
ly listens on local socket. What kind of vulnarability does mysql have? Do you know where I can read about it? Oleg. On Sun, Apr 4, 2010 at 4:55 PM, Daniel Reinhardt wrote: > > -- > From: "Oleg Goryunov" > Sent: 03 April,

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-04 Thread Oleg Goryunov
ut any evidence on your server of being hacked." Unfortunately, they said they did not have a database of registered events of this kind. :( Oleg. On Sun, Apr 4, 2010 at 12:48 PM, Oleg Goryunov wrote: > Lester, > Yes, I assume it might be a third party problem, not my server proble

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-04 Thread Oleg Goryunov
, Apr 4, 2010 at 10:20 AM, Lester Caine wrote: > Oleg Goryunov wrote: > >> >> Any help is appreciated. >> > > Oleg - Does YOUR copy of the index page look OK reading it as a file? > What no one has mentioned is that DNC servers have been hacked and could be > doin

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-04 Thread Oleg Goryunov
phpinfo(); HTTP/1.1" 404 675 "-" "Mozilla/4.0 (compatible; MSIE 6. mysite.com:80 218.8.251.187 - - [02/Apr/2010:13:44:24 -0500] "GET //p/m/a/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 675 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Wi So, I suspect tha

Re: [us...@httpd] Someone hacked my apache2 server

2010-04-03 Thread Oleg Goryunov
Nick, Thanks for your reply. THe problem is that I do not see any files changed on the server (and thus cannot check the owner of them). Where should I look for the possible evidence of someone else being there? On Sun, Apr 4, 2010 at 2:05 AM, Nick Kew wrote: > > On 3 Apr 2010, at 22:20

[us...@httpd] Someone hacked my apache2 server

2010-04-03 Thread Oleg Goryunov
Hello all, It looks like someone hacked my apache2 server and I am trying to understand how this could have happened. This is what happened: All of a sudden the server - in response to a web-browser request for a page - started to give a full screen of unknown characters (looked like a long text wi