Debian – Checking System Integrity After Possible Rootkit

To find all Debian managed configuration files which have been changed from the default you can use a command like this.

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}'

Edit (works with localized systems):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}' | sort | less

Edit (works with packages with OK in the filename):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK$/{print $1}' | sort | less

Try these:

sudo apt-get purge mysql-common mysql-server-5.1
sudo apt-get install mysql-server

Note that you don't need to purge mysql-server since it's just a meta-package (i.e. it's a convenience package containing just dependency info). Also, pay attention to the output of the purge option. It might display directories that aren't purged, and then you can remove those manually.