Reset unknown root password

[Gnarlodious]

This is stupid I know. In my fumbling around with mySQL and phpMyAdmin an
internet intruder has gone and set a password unknown to me.
Incredibly, I was only online for 3 hours when this happened and I spotted
it on a log.

I replaced the mySQL folder and updated the version but I still can't log
in.

Will one of you Gurus tell me how to just dump everything and start over?

Thank you

Ver 8.40 Distrib 4.0.20, for apple-darwin7.3.0
-- Gnarlie
http://www.Gnarlodious.com/

[Aggro]

Gnarlodious wrote:

This is stupid I know. In my fumbling around with mySQL and phpMyAdmin an
internet intruder has gone and set a password unknown to me.
Incredibly, I was only online for 3 hours when this happened and I spotted
it on a log.

Resetting the root password is not enough, the intruder might have set
other accounts for him/her/it -self, so you would need to remove all
user accounts, and change all passwords.

And are you sure the database is only that got hurt? It is common for
intruders to open few backdoors for them to use later. How did the
intruder get it? What else might be infected? Did you have a root
account for remote logins, but without a password?
http://dev.mysql.com/doc/mysql/en/Re...rmissions.html

[Gnarlodious]

Entity Aggro spoke thus:

Gnarlodious wrote:

This is stupid I know. In my fumbling around with mySQL and phpMyAdmin an
internet intruder has gone and set a password unknown to me.
Incredibly, I was only online for 3 hours when this happened and I spotted
it on a log.
Resetting the root password is not enough, the intruder might have set
other accounts for him/her/it -self, so you would need to remove all
user accounts, and change all passwords.

I think I'm safe since the logs showed no other invasive activity at the
time (4 months ago).

No unknown user as shown up in NetInfo either.
And are you sure the database is only that got hurt? It is common for
intruders to open few backdoors for them to use later. How did the
intruder get it? Through phpMyAdmin, which is open to the world by default. In any case, I'm
on a dynamic IP so I'm a moving target.
What else might be infected? Did you have a root
account for remote logins, but without a password? MySQL is running well on my laptop, but it's not the server. I may be doing
this wrong but I'm saying:
mysql-h 192.168.2.1 -uroot -p

but all I get is a 5 minute timeout with error:

ERROR 2003: Can't connect to MySQL server on '192.168.2.1'.
http://dev.mysql.com/doc/mysql/en/Re...rmissions.html

Thanks, I'll study that tomorrow.
-- Gnarlie
http://www.Gnarlodious.com/Cogent/Cogent.html