ping22: can not kill this process

3 msg	Are the patches from the recent DSAs incorporat...
1 msg	www.pymexpress.com.ar
4 msg	Re: www.juniorguide.com
1 msg	www.chequesonline.com.ar
1 msg	www.lipoaspirasion.com.ar

ping22: can not kill this process
\ Mike Wang (30 Dec 2007)
. \ Török Edwin (30 Dec 2007)
. \ Mike Wang (30 Dec 2007)
. \ Bill Marcum - New Address! (31 Dec 2007)
. \ Bernd Eckenfels (31 Dec 2007)
. . \ Mike Wang (31 Dec 2007)
. . . \ Jan Luehr (31 Dec 2007)
. . . . \ Mike Wang (2 Jan 2008)
. . . . . \ Luis Mondesi (2 Jan 2008)
. . . . . . \ Mike Wang (2 Jan 2008)
. . . . . . . \ Mike Wang (3 Jan 2008)
. . . . . . . . \ Luis Mondesi (4 Jan 2008)
. . . . . . . . . \ Mike Wang (4 Jan 2008)
. . . . . . . . . \ Rick Moen (4 Jan 2008)
. . . . . . . . . . \ Felipe Figueiredo (4 Jan 2008)
. . . . . . . . . . . \ Steve Kemp (4 Jan 2008)
. . . . . . . . . . \ Javier Fernandez-Sanguino (4 Jan 2008)
. . . . . . . . . . . \ Rick Moen (4 Jan 2008)
. . . . . . . . . \ Marcin Owsiany (4 Jan 2008)
. . . . . . . . \ Bernd Eckenfels (4 Jan 2008)
. . . . . . . . . \ Hubert Chathi (4 Jan 2008)
. . . . . . . . . . \ Bernd Eckenfels (4 Jan 2008)
. . . . . . . . . . . \ Hubert Chathi (4 Jan 2008)
. . . . . . . . . . . . \ Bernd Eckenfels (5 Jan 2008)
. . \ Raphael Geissert (4 Jan 2008)
. . . \ Rick Moen (4 Jan 2008)
. . . \ Javier Fernández-Sanguino Peña (7 Jan 2008)
. \ Thomas Hochstein (5 Jan 2008)
. \ Paul Hink (5 Jan 2008)
. . \ Luis Mondesi (5 Jan 2008)
. . . \ Rick Moen (5 Jan 2008)

2 msg	Re: (CVE-2007-0855) Preparation of the next sta...
4 msg	Amir Mechouk är inte på kontoret.
7 msg	Re: [SECURITY] [DSA 1438-1] New tar packages fi...
6 msg	new updates, no recent DSAs.... Hmmmm
1 msg	AUTO: Johannes Paechnatz ist außer Haus (Rückke...
2 msg	Flash 9.0.31 as distributed in Etch is insecure
1 msg	Re: Bug#439335: CVE-2007-4131: GNU tar Director...
11 msg	Re: [SECURITY] [DSA 1435-1] New clamav packages...
2 msg	Squirrelmail archive compromission and version ...
6 msg	PCI vulnerability scan - PHP4 on Sarge
1 msg	Robert B Jackson is on vacation.
2 msg	Manipulated squirrelmail download archives - ho...
26 msg	large campus network ... sugestions
1 msg	Medical Doctor List in the United States

Subject:	ping22: can not kill this process
Group:	Debian-security
From:	Mike Wang
Date:	30 Dec 2007

Hi
Recently one of my web server was invaded by something called ping22.
it obviously exploited some perl cgi or php holes on this apache2 server.
But I do not how it is get exploited.

(1) tried to kill -9 it, it is respawn again automatically.

# ps -ef | grep ping22
www-data 16848 1 14 14:01 ? 00:06:07 ping22
root 18881 30331 0 14:43 pts/0 00:00:00 grep ping22

how can I kill it?

(2)
And from /proc/16848, the cmdline shows ping22. and
lrwxrwxrwx 1 www-data www-data 0 2007-12-30 14:50 exe -> /usr/bin/perl

tried to find / -name "*ping22*", can not find the file. How is ping22 get
started?

(3) the kern.log showed, this ping22 seems has something to do irc.

Dec 30 14:55:50 kernel: audit(1199044550.571:589724): avc: denied {
name_connect } for pid=16848 comm="perl" dest=6667
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:ircd_port_t:s0 tclass=tcp_socket

Any one has a idea of this ping22?

thanks .

Mike