On Wed, Mar 02, 2005 at 06:12:05PM -0500, Chris Strzelczyk wrote:
if ($args =~ /^\001VERSION\001$/) { notice("$pn", "\001VERSION rootworm-$VERSAO in perl \001");
Oh dear. Seems to connect to undernet irc, and wait for commands botnet-style by the looks of things (caveat: my perl-fu is weak).
What public facing scripts were you running on that server? You've already ruled out phpBB, but anything else ?
If you haven't done so already, I'd kill that process, take the box offline for forensic purposes, and don't put it back online until it's been reinstalled.
Dave