plesk kernel: application bug: perl

[PixyPumpkin]

Hi, last night i received an error from Plesk:

May 29 01:48:04 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().
May 29 01:48:04 plesk kernel: (see the NOTES section of 'man 2 wait'). Workaround activated.
May 29 02:00:25 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().

This error generated 50GB of traffic within a couple of hours.
Does anybody know how to solve this problem?

After a reboor all seemed fine, but will it come back?

Thx!

 

[Griffith]

There can be more than one thing that causes this, but last time I got it, it was a hacker who were running a perl wget program... it ran as perl, but said "/usr/bin/httpd -DSSL" when I used ps -aux, and you could also see it while running "netsat -nlp"

Check /tmp if there is suspicous files...

 

[PixyPumpkin]

Wow, this is exactly what happened, the file wget.pl was indead in the /tmp Thx!

 

[Griffith]

But, you should do something with it.. if you search every httpd error_log after admin_styles.php I think it was.. you will probably find wich site this hack came from.. will guess it is a phpBB exploit..

grep -lir "admin_styles.php" /path/to/sites/httpd_logs/error_log


Another thing... you said it genreated 50GB transfer... do you have any clue what it was getting and where it was stored?

 

[PixyPumpkin]

I had only one phpBB running, I deleted it.

 

[PixyPumpkin]

Another thing... you said it genreated 50GB transfer... do you have any clue what it was getting and where it was stored?

Not a cleu, the disk space did not change?