So i own a hosting company and one of my clients
had 3 scripps in his cgi-bin directory that were
93211.z 21939.z and 02193.z, the reason we found
these was that he had around 47 perl procs taking up
50 percent CPU usage, when we looked, those were
the only scrips found. yet after i unzipped em, they
were .dats full of non-human readable messages
under the name of
plainmail_sc9938382828_2893983.dat, These 47
perl procs were also causing around 3 Gigs of
transfer a day, but the weird part was that not only
his ip but the others in the pool that he has no
control over were also getting high amounts of traffic
when the scrips were running, unfortunaty after
sending an email, he immediatly stopped so no new
data could be gathered and all 3 of those scrips
disapeared from his account. My question for all is
how was he able to create 600megs of outgoing
packets for the other ip's that he couldnt control, and
please not that i am 99.9 percent sure that the
system was NOT compermised. Well thanks in
advance.