I am just trying to figure out if I have to re-install. It look like it. Vulnerability in PHP or PHPBB I think.
I found the perl script in /tmp
Or maybe secure /tmp and take the below steps.
Thoughts on this all?
It's clearly hacker activity.
Beyond closing whatever vulnerability caused this, have you checked to see if the system has been trojaned? It's not perfect, but "rpm -Va" is a quick and dirty way to do it.
A better way is to check using Tripwire or a similar tool, if you installed one.
Rich
