Pain removing a perl rootkit

If I can give you any advice, it is to stop wasting your time cleaning up. Make an image of the OS for forensic stuff for later, and just reinstall the server.

Sorry, but its the only secure way to resolving yourself from being rootkitted.

Later you can check the image, for certain reasons, why it happened.

From my own personal experience, I did this, and later found an internal user which had a SSH key containing the flaw of openssl in 2008.

I hope, it clears up the things.

Note:
If you are going to image/backup the server before reinstalling, be very careful, how you do this. As @dfranke said, boot from a trusted medium to backup.

You shouldn't connect to other machines from a rooted server, as great rootkits are known to be able to spread through trusted sessions such as SSH.

The commandline can be changed if the process alters argv[0]. Try ls -l /proc/[pid]/exe

From man 5 proc

this file is a symbolic link containing the actual pathname of the executed command. This symbolic link can be dereferenced normally; attempting to open it will open the executable. You can even type /proc/[number]/exe to run another copy of the same executable as is being run by process [number]. In a multithreaded process, the contents of this symbolic link are not available if the main thread has already terminated

ps auxwf | less gives you the "forest view" of processes which can show you what process launched this process (unless the rootkit is hiding it, or the app's parent has exited and it's been reparented to init).

This would be mostly academic and probably just a timewaster, but strings -n 10 /proc/[pid]/mem might be fun to watch scroll past. You could also echo 0x7 > /proc/[pid]/coredump_filter and use gdb gcore to force a coredump with everything possible in it, but then the process dies, which could block further analysis.

But definitely take Arenstar's advice. Back up data only, restore everything executable from backups, and start over. You should probably restore the website from backups as well, there could be malicious javascript added to every html or php file. If you're considering legal action, you'll want to just set the machine aside, unplug it from the net, and stop whatever it is you're doing until forensic experts have done their job.

Try "cat /proc/[process id]/cmdline" Though if it is a true rootkit it may modify the kernel to hide itself better.

You should reinstall, I agree. Have you tried escaping the characters in the path? Maybe one of those slashes is actually part of a filename and not a directory. At the very least you should use iptables to block outbound traffic to that host or IRC general until fixed. Check netstat as well.

I'd think by now you have reinstalled. Your justing wasting time trying to track the processes and do forensics as chances of anything legally developing from it would be very minute and chances of finding the hacker would be futile anyway. Unless it just interests you to research and reverse rootkits which can be fun:)