As a bit of background, it seems that our server got infected with something and is being used to open a ton of TCP connections over a large range if IPs. I'm halfway through trying to track down how our server got infected now; my tale of woe has been outlined at 398639 for anyone who wants some additional information.
The current issue is I've found an Apache command "con.shs" that is routinely taking up 100% of our CPU (it's definitely possible it's related to our server compromise).
My question is if anyone knew what "con.shs" is and why it's running at 100%? No Google search has returned anything that might help.
We're running Centos 5.7 Final, and Apache 2.2.3 (with PHP and MySQL).