3

On my Linux server, i am getting a suspicious perl process, which is trying to send spam from my server, using a perl script. Here is the ps -aux output.

apache     10078  0.0  0.0   4028   705 pts/1    S+   15:50   0:00 [perl]
apache     10079  0.0  0.0   4023   433 pts/1    S+   15:50   0:00 [perl]
apache     10080  0.0  0.0   4024   432 pts/1    S+   15:50   0:00 [perl]
.
.
.

There are more than 20 of such processes running and each one of them is consuming a lot of Sockets.

unable to find the script's location, path and detail as its just "perl" written there. I tried to use lsof to see its opened files, it shows a big number of sockets and files opened by one website hosted on my server. but i cannot get a clue from there that which script is this, so that i can track and remove it.

Thanks

2 Answers 2

3

lsof -p against the relevant process ID's will tell you where to look...

For instance, lsof -p 10078 will give you a listing of all the open files associated with that process. Take a look at the output and work back to see which files are in use.

3
  • that i have already tried. but does it reveals the information about the actual path of the script? that where it is located?
    – Farhan
    Nov 7, 2012 at 16:04
  • It's probably a CGI script. Restart Apache and see if it goes away.
    – ewwhite
    Nov 7, 2012 at 16:08
  • it does go away but comes back at random intervals in a day.
    – Farhan
    Nov 7, 2012 at 16:11
3

I found a solution using which you can know the Exact path of the system/kernel perocess, enclosed in brackets , like [perl]

readlink -f /proc/{PID of process}/exe

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .