Ok, I need to get some homework done and go to bed. For the time being:
- There are no odd services listening or connections established. But that doesn't mean anything.
- I've changed the root password, but I don't believe that he ever got access to root.
- I've changed the MySQL password (you might have noticed the authentication failure).
- I've hacked the SMF board to give myself administrator-type power. I don't have time to muck around with names and stuff tonight, maybe later. If you're nice.
- I've disconnected everybody who had an active connection.
For everything else, I'm going to leave it as business as usual. I can't tell what happened, so there's no sense in closing the gate after the horse escaped.
To be continued...