i am getting these emails from root
i have been getting emails from root with suspicious file alert with this messages
File: /tmp/installd/perl588installer/CPAN-SQLite-0.196/t/01basic.t
Reason: Script, starts with #!
Owner: :
Action: No action taken
File: /tmp/installd/perl588installer/cleanversion
File: /tmp/installd/perl588installer/install.tdy
T
ime: Wed Nov 18 19:23:45 2009 +1030
PID: 1600
Account: nobody
Uptime: 1805 seconds
Executable:
/usr/local/bin/perl
Command Line (often faked in exploits):
spamd child
Network connections by the process (if any):
tcp: 127.0.0.1:783 -> 0.0.0.0:0
tcp: 127.0.0.1:783 -> 127.0.0.1:36704
Files open by the process (if any):
/dev/null
/dev/null
/dev/null
/usr/local/bin/spamd
/usr/local/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/Plugin/VBounce.pm
Is this normal?? or there is something wrong
Edit:
This is the output of lsof|grep '/tmp
root@cpanel [~]# root@cpanel [~]# lsof|grep '/tmp/installd'
root@cpanel [~]# root@cpanel [~]# lsof|grep '/tmp'
cpdavd 3310 root 0r REG 0,216 16658 106111164 (deleted) /tmp/sh-thd-1258730813
httpd 4020 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 7753 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 7970 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 11989 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 21987 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 21988 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 24054 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 24315 root 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 26560 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 26562 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B
httpd 30318 nobody 33u REG 0,216 0 106111145 (deleted) /tmp/ZCUD8EQE1B