简体繁体 English

MySQL InnoDB auto_increment值增加2而不是1.病毒？

[英]MySQL InnoDB auto_increment value increases by 2 instead of 1. Virus?

原文 2010-08-28 10:29:23 7 2 mysql/ innodb/ auto-increment/ virus

There's an InnoDB table for storing comments for blog posts used by a custom built web application. 有一个InnoDB表，用于存储自定义构建的Web应用程序使用的博客帖子的注释。

Recently I noticed that the auto incremented primary key values for the comments are incrementing by 2 instead of just 1. 最近我注意到注释的自动递增主键值增加了2而不是1。

I also noticed that in another MySQL table which is used for remembering the last few commenter's footprint signature (eg ip, session id, uagent string, etc) the name of the PHP session starts with "viruskinq" which is weird because I thought it should always be a hexadecimal md5-like string. 我还注意到在另一个MySQL表中用于记住最后几个评论者的足迹签名（例如ip，会话ID，uagent字符串等），PHP会话的名称以“viruskinq”开头，这很奇怪，因为我认为它应该始终是十六进制的类似md5的字符串。

Google yields only a couple of results for "viruskinq", all in Turkish. Google只为“viruskinq”提供了几个结果，全都是土耳其语。 It is interesting because approximately a year ago the website in question was defaced by Turkish villains. 这很有意思，因为大约一年前，有关网站被土耳其恶棍破坏了。 (I'm 100% sure that the attackers didn't succeed because of any security holes in my app, because other websites, hosted by the same company, were defaced too at that time.) （我100％确定攻击者没有成功，因为我的应用程序中存在任何安全漏洞，因为当时由同一家公司托管的其他网站也被污损了。）

The site is on a shared host, using Linux. 该站点位于共享主机上，使用Linux。

Do you think it is possible that the server itself may still be under the influence of those hackers? 您是否认为服务器本身可能仍然受到黑客的影响？ Examining the comment's id values revealed that this doubling phenomena exists since this May, but the defacing happened almost a year ago. 检查评论的id值显示，自今年5月以来存在这种倍增现象，但这种破坏发生在差不多一年前。

What other causes could there be that explain the weird behavior of the auto increment value? 还有什么其他原因可以解释自动增量值的奇怪行为？ The application hasn't been changed and at older comments the auto incremented primary key values are in order. 应用程序尚未更改，在较旧的注释中，自动递增的主键值按顺序排列。

Edit: Summary of the solution 编辑：解决方案摘要

The hosting company informed me that the reason of the doubled auto increment value is because they use a Master-Slave MySQL architect and according to them this phenomena is normal. 托管公司告诉我，自动增量值增加一倍的原因是因为他们使用了Master-Slave MySQL架构师，据他们说这种现象是正常的。

They also admitted that various hackers are constantly attacking their servers, "especially the sessions" and they cannot do anything about it. 他们还承认，各种黑客不断攻击他们的服务器，“特别是会议”，他们无法对此做任何事情。

I think I better start packing my things and move to a better webhost. 我想我最好开始打包我的东西并转向更好的虚拟主机。

2 个解决方案

I really, really doubt this is a virus. 我真的非常怀疑这是一种病毒。 Double-check whether that really is the session ID that starts with that string (which would indeed be reason for some concern). 仔细检查是否真的是以该字符串开头的会话ID （这确实是某些问题的原因）。 My guess would be this is a kid who discovered how to alter the User Agent string in the browser, and you are seeing the results of that, which is entirely harmless. 我的猜测是，这是一个发现如何改变浏览器中的用户代理字符串的孩子，你看到的结果是完全无害的。

In regards to the increment problem. 关于增量问题。

First, check the auto_increment_increment setting of your mySQL server. 首先，检查mySQL服务器的auto_increment_increment设置。 Maybe it was set to 2 for some reason? 可能由于某种原因它被设置为2？
Second, if it's not that, I would look at all DELETE operations that the comment system runs on the table. 其次，如果不是这样，我会查看注释系统在表上运行的所有DELETE操作。 Do comments recognized as spam get deleted? 被视为垃圾邮件被删除的评论？ Can you log deletions for a while, or switch to soft deletions? 您可以暂时删除删除，还是切换到软删除？
Also, try to create some subsequent comments yourself. 此外，尝试自己创建一些后续评论。 Does the same phenonmenon occur? 是否会出现相同的现象？ What if you add records using mySQL manually? 如果您手动使用mySQL添加记录怎么办？
Look through the PHP code inserting a submitted comment making really sure there is nothing that could lead to this behaviour. 查看插入提交的评论的PHP代码，确保没有任何可能导致此行为的内容。
Try moving the comment system to a different server - preferably a local one, maybe freshly set up - to see whether the behaviour persists there. 尝试将评论系统移动到另一台服务器 - 最好是本地服务器，可能是新设置的 - 以查看该行为是否仍然存在。