System crash and a lot of lines in dmesg with ssh-scan segfault

Client called me because can’t access to the application.
So login in system and surprise! I cant execute ps, ls and netstat commands and postgresql is down. These files has other owners.

The last lines in dmesg are like :

[21461.249801] ssh-scan[11199]: segfault at 0 ip 0000000008048e33 sp 00000000ffd12d10 error 4 in ssh-scan[8048000+c0000]

What could be the problem? And the solution?

The OS: Ubuntu Server 12.04LTS x64

You’ve been compromised an the attacker seems to have been running an ssh scanning bot against external hosts.

The solution is up to you, but I suspect that you will need to rebuild the server after recovering any important data.

Check more discussion of this question.

Related posts:

1. SSH broken, segfault error 4
2. Scan whole system or just user dirs with clamav
3. getting interface names from dmesg lines
4. Manage a lot of open ssh sessions to servers with id’s for hostname
5. SSH if command output is more than about 5 lines