I've got a process running on my server (CentOS 5.2) that is taking up 99-100% of my CPU. The ps command reveals the name fakeproc as follows:
30571 ? R 3620:06 fakeproc
Running top shows me that it's a perl script that is associated with this process:
30571 apache 25 0 6292 3044 1288 R 100 0.1 3621:44 perl
I tried to investigate, but didn't get much info on the location of the perl script:
$ ps -p 30571 -o command COMMAND fakeproc
I'm pretty sure I've got some malware (a perl script of some kind) that is creating this fakeproc, but I have no idea how to locate it or how to remove it.