The Ubuntu Web server that I just inherited has been compromised. I'm a Windows admin and not all too familiar with Linux.

How would I go about finding out what keeps spawning perl processes? I killed a couple dozen instances of /usr/bin/perl but they are spawned again immediately. I've even renamed /usr/bin/perl but the processes still come back.

I recognize that I'll have to nuke the server, but I need to set up a replacement before I can take the website offline.