From owner-freebsd-isp@FreeBSD.ORG  Thu Apr 24 07:36:28 2003
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1840737B404
	for <freebsd-isp@freebsd.org>; Thu, 24 Apr 2003 07:36:28 -0700 (PDT)
Received: from mail.trident-uk.co.uk (mail.trident-uk.co.uk [81.3.89.57])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 33FC343FBD
	for <freebsd-isp@freebsd.org>; Thu, 24 Apr 2003 07:36:27 -0700 (PDT)
	(envelope-from jamie@tridentmicrosystems.co.uk)
Received: from localhost (localhost.pe.trident-uk.co.uk [127.0.0.1])
	by mail.trident-uk.co.uk (Postfix) with ESMTP
	id 12AAD56A; Thu, 24 Apr 2003 15:36:19 +0100 (BST)
Received: from jamieheckford (wrkstn-74.pe.trident-uk.co.uk [192.168.100.74])
	by mail.trident-uk.co.uk (Postfix) with ESMTP
	id 3F50862C; Thu, 24 Apr 2003 15:36:18 +0100 (BST)
From: "Jamie Heckford" <jamie@tridentmicrosystems.co.uk>
To: "'Dave [Hawk-Systems]'" <dave@hawk-systems.com>
Date: Thu, 24 Apr 2003 15:36:02 +0100
Organization: Trident Microsystems Ltd.
Message-ID: <00b801c30a6e$d465d670$4a64a8c0@jamieheckford>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.3416
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
In-Reply-To: <DBEIKNMKGOBGNDHAAKGNOEPBMOAB.dave@hawk-systems.com>
X-Virus-Scanned: by AMaViS perl-11
cc: freebsd-isp@freebsd.org
Subject: RE: disaster recovery after rootkit -> MySQL and user accounts
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: jamie@tridentmicrosystems.co.uk
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Apr 2003 14:36:28 -0000


> unfortunately because of the corruption of various shared 
> libraries and so forth as a result of the attack, the mysql 
> daemon (in addition to a mitfull of other standard services) 
> will not start.
> 

Surely if you still have most of the data on the drive then you can look
for the RPM database and find out what version was installed on there?
Similar to the /var/db/pkg on FreeBSD for the ports.

Jamie