MYSQL Cannot connect: invalid settings. 1.7 [SOLVED]

[startd]

OK I am lost. I came in this morning and my website was totally down. I run drupal 6.x and it says it has been set to offline mode. When I try to go to MYSQL through PHPMYADMIN which I normally do it says "phpMyAdmin tried to connect to the MySQL server, and the server rejected the connection. You should check the host, username and password in your configuration and make sure that they correspond to the information given by the administrator of the MySQL server."

I have not changed or touched anything. my settings and config files are all the same and they were set with passwords. HELP!!!!!!!!!!!!!!!!!

[Sharley]

Would you be so kind as to add your XAMPP version and Operating System to your profile as per these instructions:
viewtopic.php?f=16&t=48626
Thanks.

[startd]

Sorry

Xampp 1.7
Windows Server 2003 SP2

[Sharley]

You can add that info to your profile so you don't need to keep adding it in every post and we don't need to keep asking for it.

The link will give full info and a direct link to your profile to make it easier.

Thanks again.

[Sharley]

Thanks for fixing your profile, it is important now there are so many different versions and Windows systems to contend with.


If, as you say, you have not changed anything then this may be down to perhaps some malware infection.

Do a thorough security scan.

Check your browser under File menu item is not set to Offline mode.

Make sure of course that Apache and MySQL are both running in the control panel.

For good measure check the \xampp\apache\logs\error.log file for clues.
See if there is a MySQL error log file in the \xampp\mysql\data folder.

[startd]

I am running a virus sweep. Picked up some so far. checked the apache logs and there seems to be a string of entries like this.


[Thu Dec 22 14:06:31 2011] [error] [client 87.106.184.159] script 'C:/xampp/phpmyadmin/scripts/setup.php' not found or unable to stat, referer: http://ferry.ghaps.org/phpmyadmin/scripts/setup.php
[Thu Dec 22 14:06:31 2011] [error] [client 87.106.184.159] script 'C:/xampp/phpmyadmin/scripts/setup.php' not found or unable to stat, referer: http://207.74.27.2/phpmyadmin/scripts/setup.php
[Thu Dec 22 14:06:32 2011] [error] [client 87.106.184.159] script 'C:/xampp/phpmyadmin/scripts/setup.php' not found or unable to stat, referer: http://ghhs.ghaps.org/phpmyadmin/scripts/setup.php
[Thu Dec 22 14:06:32 2011] [error] [client 87.106.184.159] script 'C:/xampp/phpmyadmin/scripts/setup.php' not found or unable to stat, referer: http://ferry.ghaps.org/phpmyadmin/scripts/setup.php

Is this normal? Can say I study the logs often.

[startd]

Any way for me to get in and change the password? Once virus free is there anything I can do to get back in?

[Sharley]

The error messages are telling you someone is trying to access a secure section of your server to run a script which does not exist in your version of XAMPP.

Take a look in the C:\xampp\webdav folder and you should only see 2 files:
index.html
webdav.txt
If there are more than that then you have been compromised and you need to correct the problem.
See the link in my signature for some info and solutions.
This is a well know entry point for script kiddies to turn your server into a zombie.


Until the malware and a possible webdav exploit is cleaned up it may be futile to try and do anything with your XAMPP installation.

Can you remember how you set the MySQL\phpMyAdmin root password in the first place?

Can you access phpMyAdmin using just username root with no password?

Do you see a screen with a place to put your root username and password?

In C:\xampp\phpmyadmin folder is a file config.inc.php and if you drag that file into an open text/code editor like notpad++ or notepad the does this line look like this

Code: Select all

$cfg['Servers'][$i]['auth_type'] = 'config';

If it does then change it to look like this

Code: Select all

$cfg['Servers'][$i]['auth_type'] = 'cookie';

Save the file and try and restart Apache and MySQL.

Don't change or add anything else in this file at this stage.

Please let me know when you have cleaned up the malware and possibly the webdav folder then we can proceed to sort out any other issues.


BTW this is the full error message from your web site when I tried to access it

Site off-line

The site is currently not available due to technical problems. Please try again later. Thank you for your understanding.

If you are the maintainer of this site, please check your database settings in the settings.php file and ensure that your hosting provider's database server is running. For more help, see the handbook, or contact your hosting provider.

The mysqli error was: Access denied for user 'root'@'localhost' (using password: YES).

The last part usually means the MySQL server is not running so check in the control panel that it has started and keeps running.

To get the above page it means Apache has started.

Can you access http://localhost/xampp/index.php and test the demos especially the database demos?


Good luck.

[startd]

The server is clear of malware. found 15. scans come back clean now. Webdav only has the two files. I set up phpmyadmin using the config file. All the config files for phpmyadmin and the drupal config.php files match a previous backup. I changed the auth to cookie and got the login screen. I tried the root and the password I have documented and root with no password. Neither worked. It is like someone logged in and changed the password. I have seen some posts using a script from the windows command line to force the password to change for phpmyadmin but they dont work. I am stumped. Any other thoughts. I really appreciate your help.

[Sharley]

In C:\xampp\mysql folder you will see resetroot.bat file give that a go and if successful then try and login to phpMyAdmin with root and no password.

You then set a new root password by going to http://localhost/xampp/index.php and select the Security tab and follow the link on the main window.

Let me know how it goes and I am pleased that the webdav folder was clear - you should read the link in my sig and secure it anyway, just in case.

[startd]

that seemed to work. i can get into phpmyadmin now but the site is still telling me it cannot connect. localhost/xampp/index.php comes up but security is forbidden.

[startd]

Nevermind. I made a more secure password and need to change it in the settings.php file. Thank you for all your help! YOU ROCK!!!!

[Sharley]

Thanks for the feedback and yes your site is up and running again.

You should now go through everything and make sure this malware has not done any more damage.

I will close this topic now and mark it solved and if you have any other issues please feel free to start a new topic.

Best wishes.