MySQL InnoDB auto_increment value increases by 2 instead of 1. Virus?

Question

There's an InnoDB table for storing comments for blog posts used by a custom built web application.

Recently I noticed that the auto incremented primary key values for the comments are incrementing by 2 instead of just 1.

I also noticed that in another MySQL table which is used for remembering the last few commenter's footprint signature (e.g. ip, session id, uagent string, etc) the name of the PHP session starts with "viruskinq" which is weird because I thought it should always be a hexadecimal md5-like string.

Google yields only a couple of results for "viruskinq", all in Turkish. It is interesting because approximately a year ago the website in question was defaced by Turkish villains. (I'm 100% sure that the attackers didn't succeed because of any security holes in my app, because other websites, hosted by the same company, were defaced too at that time.)

The site is on a shared host, using Linux.

Do you think it is possible that the server itself may still be under the influence of those hackers? Examining the comment's id values revealed that this doubling phenomena exists since this May, but the defacing happened almost a year ago.

What other causes could there be that explain the weird behavior of the auto increment value? The application hasn't been changed and at older comments the auto incremented primary key values are in order.

Edit: Summary of the solution

The hosting company informed me that the reason of the doubled auto increment value is because they use a Master-Slave MySQL architect and according to them this phenomena is normal.

They also admitted that various hackers are constantly attacking their servers, "especially the sessions" and they cannot do anything about it.

I think I better start packing my things and move to a better webhost.

Answer 1

I really, really doubt this is a virus. Double-check whether that really is the session ID that starts with that string (which would indeed be reason for some concern). My guess would be this is a kid who discovered how to alter the User Agent string in the browser, and you are seeing the results of that, which is entirely harmless.

In regards to the increment problem.

• First, check the auto_increment_increment setting of your mySQL server. Maybe it was set to 2 for some reason?

• Second, if it's not that, I would look at all DELETE operations that the comment system runs on the table. Do comments recognized as spam get deleted? Can you log deletions for a while, or switch to soft deletions?

• Also, try to create some subsequent comments yourself. Does the same phenonmenon occur? What if you add records using mySQL manually?

• Look through the PHP code inserting a submitted comment making really sure there is nothing that could lead to this behaviour.

• Try moving the comment system to a different server - preferably a local one, maybe freshly set up - to see whether the behaviour persists there.