# 5.7.26-29-57-log Percona XtraDB Cluster now tables can not be read **URL:** \ **Category:** Percona Server for MySQL 5.7\ **Created:** [September 14, 2019, 2:46am UTC](https://forums.percona.com/t/5-7-26-29-57-log-percona-xtradb-cluster-now-tables-can-not-be-read/7201 "2019-09-14T02:46:54Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MasterCATZ](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@MasterCATZ](https://forums.percona.com/u/MasterCATZ)\ **Post date:** [September 14, 2019, 2:46am UTC](https://forums.percona.com/t/5-7-26-29-57-log-percona-xtradb-cluster-now-tables-can-not-be-read/7201/1 "2019-09-14T02:46:54Z")
Ubuntu did a few updates recently one of them was Server version: 5.7.26-29-57-log Percona XtraDB Cluster (GPL), Release rel29, Revision 03540a3, WSREP version 31.37, wsrep\_31.37 Now nothing seems to be able to access the DB , seems to be user rights issue but SHOW GRANTS FOR root@localhost; ±--------------------------------------------------------------------+ | Grants for root@localhost | ±--------------------------------------------------------------------+ | GRANT ALL PRIVILEGES ON _._ TO ‘root’@‘localhost’ WITH GRANT OPTION | | GRANT PROXY ON ‘’@‘’ TO ‘root’@‘localhost’ WITH GRANT OPTION | ±--------------------------------------------------------------------+ 2 rows in set (0.00 sec) Trying to do a backup aio@aio:~$ mysqldump -u root -p --lock-for-backup --all-databases \> full-backup-$(date +%F).sql Enter password: mysqldump: Couldn’t execute ‘SHOW FIELDS FROM `episode_view`’: View ‘video116.episode\_view’ references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them (1356) Website Fatal error: Uncaught Exception: Error: Table ‘opencartGTAGF.oc\_session’ doesn’t exist Error No: 1146 SELECT `data` FROM `oc_session` WHERE session\_id = ‘72c913db630cbd07783a2649bd’ AND expire \> 1568448394 in /var/www/html/system/library/db/mysqli.php:40 Stack trace: #0 /var/www/html/system/library/db.php(45): DB\MySQLi-\>query(‘SELECT `data` F…’) #1 /var/www/html/system/library/session/db.php(21): DB-\>query(‘SELECT `data` F…’) #2 /var/www/html/system/library/session.php(72): Session\DB-\>read(‘72c913db630cbd0…’) #3 /var/www/html/system/framework.php(106): Session-\>start(‘72c913db630cbd0…’) #4 /var/www/html/system/startup.php(104): require\_once(‘/var/www/html/s…’) #5 /var/www/html/index.php(19): start(‘catalog’) #6 {main} thrown in /var/www/html/system/library/db/mysqli.php on line 40 Fatal error: Uncaught Exception: Error: Table ‘opencartGTAGF.oc\_session’ doesn’t exist Error No: 1146 REPLACE INTO `oc_session` SET session\_id = ‘72c913db630cbd07783a2649bd’, `data` = ‘’, expire = ‘2019-09-14 09:06:34’ in /var/www/html/system/library/db/mysqli.php:40 Stack trace: #0 /var/www/html/system/library/db.php(45): DB\MySQLi-\>query(‘REPLACE INTO `o...') #1 /var/www/html/system/library/session/db.php(32): DB->query('REPLACE INTO `o…’) #2 /var/www/html/system/library/session.php(81): Session\DB-\>write(‘72c913db630cbd0…’, Array) #3 [internal function]: Session-\>close() #4 {main} thrown in /var/www/html/system/library/db/mysqli.php on line 40 having a look at the tables I see a lot of extensions with \_WARNING and \_encrypt , I have not yet reloaded a old backup to see if these used to be their or not yet but pretty sure they never existed mysql\_upgrade -u root -p Enter password: Checking if update is needed. Checking server version. Running queries to upgrade MySQL server. Checking system database. mysql.columns\_priv OK mysql.db OK mysql.engine\_cost OK mysql.event OK mysql.func OK mysql.general\_log OK mysql.gtid\_executed OK mysql.help\_category OK mysql.help\_keyword OK mysql.help\_relation OK mysql.help\_topic OK mysql.innodb\_index\_stats OK mysql.innodb\_table\_stats OK mysql.ndb\_binlog\_index OK mysql.plugin OK mysql.proc OK mysql.procs\_priv OK mysql.proxies\_priv OK mysql.server\_cost OK mysql.servers OK mysql.slave\_master\_info OK mysql.slave\_relay\_log\_info OK mysql.slave\_worker\_info OK mysql.slow\_log OK mysql.tables\_priv OK mysql.time\_zone OK mysql.time\_zone\_leap\_second OK mysql.time\_zone\_name OK mysql.time\_zone\_transition OK mysql.time\_zone\_transition\_type OK mysql.user OK The sys schema is already up to date (version 1.5.1). Checking databases. sys.sys\_config OK … opencartGTAGF.oc\_session\_WARNING OK opencartGTAGF.oc\_session\_encrypt OK … test.oc\_weight\_class\_description\_encrypt OK test.oc\_weight\_class\_encrypt OK test.oc\_zone\_WARNING OK test.oc\_zone\_encrypt OK test.oc\_zone\_to\_geo\_zone Warning : Percona-XtraDB-Cluster doesn’t recommend use of ADMIN command on a table (test.oc\_zone\_to\_geo\_zone) that resides in non-transactional storage engine with pxc\_strict\_mode = PERMISSIVE status : OK Upgrade process completed successfully. Could not create the upgrade info file ‘/var/lib/mysql/mysql\_upgrade\_info’ in the MySQL Servers datadir, errno: 13 ---
**Author:** ![MasterCATZ](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@MasterCATZ](https://forums.percona.com/u/MasterCATZ)\ **Post date:** [September 14, 2019, 7:12am UTC](https://forums.percona.com/t/5-7-26-29-57-log-percona-xtradb-cluster-now-tables-can-not-be-read/7201/2 "2019-09-14T07:12:20Z")
ok so it looks like something tried encrypting everything ? I restored from a old backup but how can I recover all the new data since last backup ? oc\_address\_encrypt.frm oc\_dqc\_setting\_encrypt.ibd oc\_product\_description.MYD oc\_address\_encrypt.ibd oc\_dqc\_setting.frm oc\_product\_description.MYI oc\_address.frm oc\_dqc\_setting.MYD oc\_product\_description\_WARNING.frm oc\_address.MYD oc\_dqc\_setting.MYI oc\_product\_description\_WARNING.ibd oc\_address.MYI oc\_dqc\_setting\_WARNING.frm oc\_product\_discount.frm oc\_address\_WARNING.frm oc\_dqc\_setting\_WARNING.ibd oc\_product\_discount.MYD oc\_address\_WARNING.ibd oc\_dqc\_statistic\_encrypt.frm oc\_product\_discount.MYI oc\_api\_encrypt.frm oc\_dqc\_statistic\_encrypt.ibd oc\_product\_filter\_encrypt.frm oc\_api\_encrypt.ibd oc\_dqc\_statistic.frm oc\_product\_filter\_encrypt.ibd oc\_api.frm oc\_dqc\_statistic.MYD oc\_product\_filter.frm ---
**Author:** ![MasterCATZ](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@MasterCATZ](https://forums.percona.com/u/MasterCATZ)\ **Post date:** [September 14, 2019, 7:46am UTC](https://forums.percona.com/t/5-7-26-29-57-log-percona-xtradb-cluster-now-tables-can-not-be-read/7201/3 "2019-09-14T07:46:53Z")
Sigh looks like I was hacked , well I can stop trying to chase my tail now LOCK TABLES `oc_address_WARNING` WRITE; /_!40000 ALTER TABLE `oc_address_WARNING` DISABLE KEYS /; INSERT INTO `oc_address_WARNING` VALUES (1,‘Your `oc_address` table has been encrypted. For decription you need to pay 0.060000 bitcoin to the address 1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC\nAfter payment you should go to the [url][http://bp7hhvchre5ifqd6.onion/order/1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC[/url]](http://bp7hhvchre5ifqd6.onion/order/1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC%5B/url%5D) using tor client and get your unique secret key.\nAfter receiving the key, you must execute mysql request: UPDATE oc\_address SET field = AES\_DECRYPT(field, 'YOUR-SECRET-KEY');\n\nIf you want, you can check how this works on this table. Field “secretProof” is encrypted with a simple key, execute the request:\nUPDATE oc\_address\_WARNING SET secretProof = AES\_DECRYPT(secretProof, 'keyForProof');\n\nAttention. This key does not work for your master data. Do not use it, otherwise you may permanently damage the data. To get the key you need, contact us.Field `tableStruct` contains the original names and type of your table. The key for decoding is the same as key for prof: keyForProof’,‘1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC’,‘[http://bp7hhvchre5ifqd6.onion/order/1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC](http://bp7hhvchre5ifqd6.onion/order/1nW82ZSkhT5Xzs8Gc9vWaMtDm3FAqhJXC)’,\_binary '\Z\Ï\Âb\0OòGD\ç!\ZŠ¯av€:rfqI5\ÄɃû$z‘Ÿ.€˜ev·n\áš\ÈJ Pð6N³Œ Fó\ÛU"\áž0C–\Çd\Æ{+$«\ëX1Ž[9\<#¿,‹VG·\>Ž\Ï(L\r\Æ\ï„]±]‹y\ßRÔŒ\à\Þs\Ý{ðú\Ö\â³\ÂW\Ê\ì&S®'K\ÆV1žuÀ\×\ÞX\ÒEñmŸ|',binary 'K›¶.²O³ŽqÞ®c‚Ñž ŠþVӁs†\ïIª\Ã[\Ètgœýq2ý°Â¿D\Ьšß’€ÿÿ{z•\Ï+\à8ö#w6$ºgHzrv»ñ\î‹úû‰ðš¢\Úù3ŸZ`\Ô÷šQW·\Ø[\ÞDž°œ…`\Ø0£H±g\>\ZðJY\Õl{\ÚBð\rږbmw •‰o\_ڔ¹CÁŽI'·²PTˆAJ\7\Ð)Š\Zðž Q'\Û\Ù" +œ&u\ä±ùõ†\0Eh¶-\Ä÷¢\ØT—Ÿ¯\Í\_\ÄP\0VŠÒ‡h;Q†ˆ\ÎZŠaye‘D[M’\05!‹‹0ž\Ú\ÆM?ˉŸþZ¶ý¯\r«\é…\ê\ÝB2÷¹'€/ö‘haVŒ\î{©’ó_a\Ç\äa\Ò\ÈLB%„g£ÍˆÁ²ýƒg¡œ°ý\ÜN®ýËœZR^h\ï\Å\Ò\*\ï\Ø\_\à‡\<ú\èº\îp\>n\Ã\ÇÁ\Ò\ß\í\Ö@ý+'); /\*!40000 ALTER TABLE `oc_address_WARNING` ENABLE KEYS \*/; UNLOCK TABLES;