Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I have this server and it have been compromised. I notice the perl is running a lot but there is no such of perl programming I am running. Below is my top.

top - 21:20:54 up 8 days, 13:16,  1 user,  load average: 2.02, 2.23, 2.52
Tasks:  97 total,   2 running,  93 sleeping,   0 stopped,   2 zombie
Cpu(s): 77.7%us, 22.3%sy,  0.0%ni,  0.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   1034892k total,   730176k used,   304716k free,   181616k buffers
Swap:  2097144k total,        0k used,  2097144k free,   381540k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
25687 apache    25   0  5328 2896 1176 R 49.9  0.3 818:58.72 perl
25675 apache    25   0  5328 2936 1192 S 49.6  0.3 818:58.48 perl
25564 root      15   0 10052 2928 2360 S  0.3  0.3   0:00.10 sshd
    1 root      15   0  2160  640  556 S  0.0  0.1   0:02.86 init
    2 root      RT  -5     0    0    0 S  0.0  0.0   0:00.00 migration/0
    3 root      34  19     0    0    0 S  0.0  0.0   0:00.00 ksoftirqd/0
    4 root      RT  -5     0    0    0 S  0.0  0.0   0:00.00 watchdog/0
    5 root      10  -5     0    0    0 S  0.0  0.0   0:00.38 events/0
    6 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 khelper
    7 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 kthread
   10 root      10  -5     0    0    0 S  0.0  0.0   0:01.16 kblockd/0
   11 root      20  -5     0    0    0 S  0.0  0.0   0:00.00 kacpid
   86 root      20  -5     0    0    0 S  0.0  0.0   0:00.00 cqueue/0
   89 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 khubd
   91 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 kseriod
  150 root      15   0     0    0    0 S  0.0  0.0   0:00.01 khungtaskd
  151 root      25   0     0    0    0 S  0.0  0.0   0:00.00 pdflush
share|improve this question

marked as duplicate by Wesley, Shane Madden, Mark Henderson Apr 18 '12 at 5:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 4 down vote accepted

You're probably sending spam now or doing scans. Restore from backup or reinstall. Good luck.

share|improve this answer

↓ Click the Pretty Cloud! ↓

Nuke it from orbit!

↑ You'll Like It!! ↑

share|improve this answer
    
I fully support this answer. –  Shane Madden Apr 18 '12 at 5:23
1  
Can I get royalties on your use of this image ? –  Iain Apr 18 '12 at 7:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.