Possible Duplicate:
My server's been hacked EMERGENCY
I have this server and it have been compromised. I notice the perl is running a lot but there is no such of perl programming I am running. Below is my top.
top - 21:20:54 up 8 days, 13:16, 1 user, load average: 2.02, 2.23, 2.52
Tasks: 97 total, 2 running, 93 sleeping, 0 stopped, 2 zombie
Cpu(s): 77.7%us, 22.3%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 1034892k total, 730176k used, 304716k free, 181616k buffers
Swap: 2097144k total, 0k used, 2097144k free, 381540k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
25687 apache 25 0 5328 2896 1176 R 49.9 0.3 818:58.72 perl
25675 apache 25 0 5328 2936 1192 S 49.6 0.3 818:58.48 perl
25564 root 15 0 10052 2928 2360 S 0.3 0.3 0:00.10 sshd
1 root 15 0 2160 640 556 S 0.0 0.1 0:02.86 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root 10 -5 0 0 0 S 0.0 0.0 0:00.38 events/0
6 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
7 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
10 root 10 -5 0 0 0 S 0.0 0.0 0:01.16 kblockd/0
11 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
86 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
89 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khubd
91 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
150 root 15 0 0 0 0 S 0.0 0.0 0:00.01 khungtaskd
151 root 25 0 0 0 0 S 0.0 0.0 0:00.00 pdflush
↓ Click the Pretty Cloud! ↓
↑ You'll Like It!! ↑
You're probably sending spam now or doing scans. Restore from backup or reinstall. Good luck.