debsums and chkrootkit came back clean. I tried installing rkhunter, but something is busted in the post-install. I need to run, but will do a closer inspection when I can. Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory On 10/09/2012 04:54 PM, Craig Stacey wrote:

DOE Counter Intelligence tells Cyber thatpokey.ci.uchicago.edu is under mysql injection from 84.235.73.254. I've asked Gene to put in a block, which he's doing.

I don't think pokey's been compromised, but can someone take a look to sanity check. The web logs show tons of activity from that IP, but I don't see anything beyond what looks like just firing a shotgun looking for holes. -- Craig