Help - Search - Members - Calendar
Full Version: strange thing
The Planet Forums > Control Panels > Plesk
javii
what do u think about this?

top - 08:56:34 up 66 days, 12:57, 1 user, load average: 5.13, 4.87, 4.79
Tasks: 251 total, 8 running, 237 sleeping, 0 stopped, 6 zombie
Cpu(s): 52.6% us, 26.2% sy, 0.0% ni, 12.9% id, 0.7% wa, 0.5% hi, 7.1% si
Mem: 2075816k total, 2067996k used, 7820k free, 117576k buffers
Swap: 1052216k total, 4k used, 1052212k free, 944784k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
13897 apache 17 0 7712 2152 5064 R 78.2 0.1 358:59.41 perl
13895 apache 21 0 7244 2124 5064 R 77.2 0.1 387:05.62 perl
13896 apache 23 0 6688 2124 5064 R 74.9 0.1 381:50.42 perl
13884 apache 16 0 7724 2120 5064 R 61.3 0.1 387:22.00 perl
13891 apache 22 0 7452 2124 5064 R 46.5 0.1 385:21.49 perl
25916 root 16 0 35368 29m 6728 S 2.3 1.5 0:19.62 spamd
31429 root 16 0 34328 28m 6728 S 2.0 1.4 1:17.57 spamd

[root@lincl89 root]# ps aux | grep perl
apache 13880 0.0 0.0 4836 1052 ? S Jul18 0:00 sh -c perl udp.pl 217.116.16.66 0 0 2>&1 3>&1
apache 13883 0.0 0.0 5240 1052 ? S Jul18 0:00 sh -c perl udp.pl 217.116.16.66 0 0 2>&1 3>&1
apache 13884 65.9 0.1 7724 2120 ? S Jul18 388:56 perl udp.pl 217.116.16.66 0 0
apache 13887 0.0 0.0 5652 1052 ? S Jul18 0:00 sh -c perl udp.pl 217.116.16.66 0 0 2>&1 3>&1
apache 13890 0.0 0.0 5784 1052 ? S Jul18 0:00 sh -c perl udp.pl 217.116.16.66 0 0 2>&1 3>&1
apache 13891 65.6 0.1 7452 2124 ? R Jul18 386:58 perl udp.pl 217.116.16.66 0 0
apache 13894 0.0 0.0 5520 1052 ? S Jul18 0:00 sh -c perl udp.pl 217.116.16.66 0 0 2>&1 3>&1
apache 13895 65.9 0.1 7244 2124 ? R Jul18 388:43 perl udp.pl 217.116.16.66 0 0
apache 13896 65.0 0.1 6688 2124 ? R Jul18 383:32 perl udp.pl 217.116.16.66 0 0
apache 13897 61.1 0.1 7712 2152 ? S Jul18 360:36 perl udp.pl 217.116.16.66 0 0

i killed all similar processes
kamihacker
check the contents of udp.pl with a text editot and paste it here

do you have egress traffic blocked with a firewall? I think you are being used as probe to check for open ports somewhere else

regards
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.