Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I have some problem with my server (running on Centos 5).

While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too much connection on smtp port.

I tried rkhunter, but nothing found.

Then I checked my web source code, I found some strange source code (.php and .pl). (they're not mine, I'm sure).

And I removed it, kill process, restart apache. But still got problem. I run "$lsof | grep ezbuyinfo" again It shows:

###########################################################################################
.......
.......
httpd.pl  7686  ezbuyinfo  cwd       DIR                8,1      4096          2 /
httpd.pl  7686  ezbuyinfo  rtd       DIR                8,1      4096          2 /
httpd.pl  7686  ezbuyinfo  txt       REG                8,1     11380     278644 /usr/bin/perl
httpd.pl  7686  ezbuyinfo  mem       REG                8,1   1693812    1251324 /lib/libc-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1    216544    1251325 /lib/libm-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     21948    1249451 /lib/libnss_dns-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     50848    1251326 /lib/libnss_files-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1    115120     342229 /usr/lib/perl5/5.8.8/i386-linux-thread-multi/auto/POSIX/POSIX.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1    135892    1249270 /lib/libpthread-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     13492    1249348 /lib/libutil-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     43616    1249421 /lib/libcrypt-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     18812    1249457 /lib/libdl-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1    107924    1250829 /lib/libnsl-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     78780    1250848 /lib/libresolv-2.5.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     20216     344920 /usr/lib/perl5/5.8.8/i386-linux-thread-multi/auto/Socket/Socket.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1     16016     342185 /usr/lib/perl5/5.8.8/i386-linux-thread-multi/auto/IO/IO.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1   1240136     342086 /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so
httpd.pl  7686  ezbuyinfo  mem       REG                8,1    128596    1250857 /lib/ld-2.5.so
httpd.pl  7686  ezbuyinfo    0r      CHR                1,3       0t0       1254 /dev/null
httpd.pl  7686  ezbuyinfo    1w      CHR                1,3       0t0       1254 /dev/null
httpd.pl  7686  ezbuyinfo    2w      CHR                1,3       0t0       1254 /dev/null
httpd.pl  7686  ezbuyinfo    3u      REG                8,1         0     259599 /tmp/.xcache.500.0.63691954.lock (deleted)
httpd.pl  7686  ezbuyinfo    4u     unix 0xffff880027e04900       0t0      69645 /var/run/mod_fcgid/3540.5
httpd.pl  7686  ezbuyinfo    5u     IPv4              84877       0t0        UDP *:54927
httpd.pl  7686  ezbuyinfo    6u     IPv4              86820       0t0        TCP 112.78.8.201:38635->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo    7u     IPv4              86810       0t0        TCP 112.78.8.201:44057->mta-v2.mail.vip.ird.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo    8u     IPv4              86770       0t0        UDP *:45036
httpd.pl  7686  ezbuyinfo    9u     IPv4              85220       0t0        TCP 112.78.8.201:40875->we-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   10u     IPv4              85282       0t0        TCP 112.78.8.201:58803->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   11u     IPv4              85287       0t0        TCP 112.78.8.201:58806->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   12u     IPv4              86812       0t0        TCP 112.78.8.201:38627->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   13u     IPv4              86815       0t0        TCP 112.78.8.201:38630->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   14u     IPv4              85424       0t0        TCP 112.78.8.201:48887->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   15u     IPv4              86805       0t0        TCP 112.78.8.201:44052->mta-v2.mail.vip.ird.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   16u     IPv4              86740       0t0        UDP *:35379
httpd.pl  7686  ezbuyinfo   17u     IPv4              86809       0t0        TCP 112.78.8.201:44056->mta-v2.mail.vip.ird.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   18u     IPv4              86822       0t0        TCP 112.78.8.201:38637->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   19u     IPv4              84892       0t0        UDP *:59981
httpd.pl  7686  ezbuyinfo   20u     IPv4              85305       0t0        TCP 112.78.8.201:56746->gh-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   21u     IPv4              84894       0t0        UDP *:60893
httpd.pl  7686  ezbuyinfo   22u     IPv4              86710       0t0        UDP *:41570
httpd.pl  7686  ezbuyinfo   23u     IPv4              86824       0t0        TCP 112.78.8.201:38639->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   24u     IPv4              85332       0t0        TCP 112.78.8.201:44726->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   25u     IPv4              86836       0t0        UDP *:57233
httpd.pl  7686  ezbuyinfo   26u     sock                0,5       0t0      87199 can't identify protocol
httpd.pl  7686  ezbuyinfo   27u     IPv4              86828       0t0        TCP 112.78.8.201:44075->mta-v2.mail.vip.ird.yahoo.com:smtp (SYN_SENT)
httpd.pl  7686  ezbuyinfo   28u     IPv4              86745       0t0        UDP *:52150
httpd.pl  7686  ezbuyinfo   29u     IPv4              86839       0t0        UDP *:44393
httpd.pl  7686  ezbuyinfo   30u     IPv4              85341       0t0        TCP 112.78.8.201:48838->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   31u     IPv4              86830       0t0        TCP 112.78.8.201:44077->mta-v2.mail.vip.ird.yahoo.com:smtp (SYN_SENT)
httpd.pl  7686  ezbuyinfo   32u     IPv4              86773       0t0        UDP *:49943
httpd.pl  7686  ezbuyinfo   33u     IPv4              86826       0t0        TCP 112.78.8.201:38641->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   34u     IPv4              86675       0t0        UDP *:60112
httpd.pl  7686  ezbuyinfo   35u     sock                0,5       0t0      86910 can't identify protocol
httpd.pl  7686  ezbuyinfo   36r     FIFO                0,6       0t0      46735 pipe
httpd.pl  7686  ezbuyinfo   37u     IPv4              86833       0t0        TCP 112.78.8.201:38648->mta-v2.mail.vip.ukl.yahoo.com:smtp (SYN_SENT)
httpd.pl  7686  ezbuyinfo   38u     IPv4              86802       0t0        TCP 112.78.8.201:44049->mta-v2.mail.vip.ird.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   39w     FIFO                0,6       0t0      46736 pipe
httpd.pl  7686  ezbuyinfo   40w     FIFO                0,6       0t0      46751 pipe
httpd.pl  7686  ezbuyinfo   41w     FIFO                0,6       0t0      46829 pipe
httpd.pl  7686  ezbuyinfo   42w     FIFO                0,6       0t0      46752 pipe
httpd.pl  7686  ezbuyinfo   43w     FIFO                0,6       0t0      46903 pipe
httpd.pl  7686  ezbuyinfo   44w     FIFO                0,6       0t0      46753 pipe
httpd.pl  7686  ezbuyinfo   45w     FIFO                0,6       0t0      46830 pipe
httpd.pl  7686  ezbuyinfo   46w     FIFO                0,6       0t0      46928 pipe
httpd.pl  7686  ezbuyinfo   47w     FIFO                0,6       0t0      46831 pipe
httpd.pl  7686  ezbuyinfo   48w     FIFO                0,6       0t0      46904 pipe
httpd.pl  7686  ezbuyinfo   49w     FIFO                0,6       0t0      47014 pipe
httpd.pl  7686  ezbuyinfo   50w     FIFO                0,6       0t0      46905 pipe
httpd.pl  7686  ezbuyinfo   51w     FIFO                0,6       0t0      46929 pipe
httpd.pl  7686  ezbuyinfo   52u     IPv4              86807       0t0        TCP 112.78.8.201:44054->mta-v2.mail.vip.ird.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   53w     FIFO                0,6       0t0      46930 pipe
httpd.pl  7686  ezbuyinfo   54w     FIFO                0,6       0t0      47015 pipe
httpd.pl  7686  ezbuyinfo   55u     IPv4              86816       0t0        TCP 112.78.8.201:38631->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   56w     FIFO                0,6       0t0      47016 pipe
httpd.pl  7686  ezbuyinfo   57u     IPv4              85176       0t0        UDP *:49990
httpd.pl  7686  ezbuyinfo   58u     IPv4              85203       0t0        TCP 112.78.8.201:44694->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   59u     IPv4              86893       0t0        UDP *:51351
httpd.pl  7686  ezbuyinfo   60u     IPv4              85390       0t0        TCP 112.78.8.201:48862->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   61u     IPv4              85392       0t0        TCP 112.78.8.201:48864->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   62u     IPv4              85208       0t0        TCP 112.78.8.201:60250->ob-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   63u     IPv4              85394       0t0        TCP 112.78.8.201:48866->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   64u     IPv4              86841       0t0        UDP *:60662
httpd.pl  7686  ezbuyinfo   65u     IPv4              85215       0t0        TCP 112.78.8.201:41860->ee-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   66u     IPv4              86819       0t0        TCP 112.78.8.201:38634->mta-v2.mail.vip.ukl.yahoo.com:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   67u     IPv4              86903       0t0        UDP *:52980
httpd.pl  7686  ezbuyinfo   68u     IPv4              86896       0t0        UDP *:48803
httpd.pl  7686  ezbuyinfo   69u     IPv4              85247       0t0        TCP 112.78.8.201:53025->qc-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   70u     IPv4              86706       0t0        UDP *:52310
httpd.pl  7686  ezbuyinfo   71u     IPv4              86899       0t0        UDP *:45077
httpd.pl  7686  ezbuyinfo   72u     IPv4              86907       0t0        UDP *:55601
httpd.pl  7686  ezbuyinfo   73u     sock                0,5       0t0      86965 can't identify protocol
httpd.pl  7686  ezbuyinfo   74u     sock                0,5       0t0      86967 can't identify protocol
httpd.pl  7686  ezbuyinfo   75u     IPv4              85281       0t0        TCP 112.78.8.201:58802->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   76u     IPv4              85202       0t0        TCP 112.78.8.201:56718->gh-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   77u     sock                0,5       0t0      86976 can't identify protocol
httpd.pl  7686  ezbuyinfo   78u     IPv4              85289       0t0        TCP 112.78.8.201:58807->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   79u     IPv4              85199       0t0        TCP 112.78.8.201:57993->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   80u     IPv4              85200       0t0        TCP 112.78.8.201:57994->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   81u     IPv4              85040       0t0        UDP *:44132
httpd.pl  7686  ezbuyinfo   82u     IPv4              85016       0t0        UDP *:42426
httpd.pl  7686  ezbuyinfo   83u     IPv4              85122       0t0        UDP *:37788
httpd.pl  7686  ezbuyinfo   84u     IPv4              85018       0t0        UDP *:47269
httpd.pl  7686  ezbuyinfo   85u     IPv4              85333       0t0        TCP 112.78.8.201:60278->ob-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   86u     IPv4              85213       0t0        TCP 112.78.8.201:58004->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   87u     IPv4              85310       0t0        TCP 112.78.8.201:44723->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   88u     IPv4              85335       0t0        TCP 112.78.8.201:48835->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   89u     IPv4              85293       0t0        TCP 112.78.8.201:58809->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   90u     IPv4              85337       0t0        TCP 112.78.8.201:48836->iy-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   91u     IPv4              85283       0t0        TCP 112.78.8.201:58804->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   92u     IPv4              85285       0t0        TCP 112.78.8.201:58805->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   93u     IPv4              85195       0t0        TCP 112.78.8.201:57990->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo   94u     IPv4              85063       0t0        UDP *:43876
httpd.pl  7686  ezbuyinfo   95u     sock                0,5       0t0      86977 can't identify protocol
httpd.pl  7686  ezbuyinfo   96u     IPv4              85174       0t0        UDP *:50156
httpd.pl  7686  ezbuyinfo   97u     IPv4              85061       0t0        UDP *:33525
httpd.pl  7686  ezbuyinfo   98u     IPv4              85037       0t0        UDP *:51027
httpd.pl  7686  ezbuyinfo   99u     IPv4              85307       0t0        TCP 112.78.8.201:48580->iy-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  100u     IPv4              85120       0t0        UDP *:36725
httpd.pl  7686  ezbuyinfo  101u     IPv4              85207       0t0        TCP 112.78.8.201:44698->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  102u     IPv4              85262       0t0        UDP *:52206
httpd.pl  7686  ezbuyinfo  104u     IPv4              85204       0t0        TCP 112.78.8.201:44695->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  105u     IPv4              85291       0t0        TCP 112.78.8.201:58808->we-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  106u     IPv4              85209       0t0        TCP 112.78.8.201:60251->ob-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  107u     IPv4              85229       0t0        TCP 112.78.8.201:40876->we-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  108u     IPv4              85242       0t0        TCP 112.78.8.201:40877->we-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  109u     IPv4              85276       0t0        UDP *:36259
httpd.pl  7686  ezbuyinfo  110u     IPv4              85197       0t0        TCP 112.78.8.201:57991->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  111u     IPv4              85312       0t0        TCP 112.78.8.201:44724->pb-in-f27.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  112u     IPv4              85198       0t0        TCP 112.78.8.201:57992->pb-in-f26.1e100.net:smtp (ESTABLISHED)
httpd.pl  7686  ezbuyinfo  113u     IPv4              85137       0t0        UDP *:42323

......

##########################################################################################

is my server be hacked? Any solution? Please...

share|improve this question

marked as duplicate by Tom O'Connor, Chopper3, EEAA, Scott Pack, Bart De Vos Jun 20 '12 at 13:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
Next time you visit serverfault please read our FAQ and don't ignore the 'Questions that may already have your answer' bit when you create a new question, saves our time and yours. –  Chopper3 Jun 20 '12 at 12:10
4  
@Tri Please don't revert my edits again. I did that for a reason. –  Tom O'Connor Jun 20 '12 at 12:13
    
I search many more, but not lucky to found your link.Yah, so sorry.. –  Tri Jun 20 '12 at 12:15

1 Answer 1

Yes. Looks like you've been rootkitted. Turn your server off immediately, and restore from the last known good backup.

Not got backups? Tough life lesson to learn there, mate.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.