Security Breach ?

[Dave Jones]

On Wed, Mar 02, 2005 at 06:12:05PM -0500, Chris Strzelczyk wrote:
 >        if ($args =~ /^\001VERSION\001$/) {
 >          notice("$pn", "\001VERSION rootworm-$VERSAO in perl \001");

Oh dear. Seems to connect to undernet irc, and wait for commands
botnet-style by the looks of things (caveat: my perl-fu is weak).

What public facing scripts were you running on that server?
You've already ruled out phpBB, but anything else ?

If you haven't done so already, I'd kill that process, take
the box offline for forensic purposes, and don't put it back online
until it's been reinstalled.

		Dave