They are probably something broken, but in case you suspect they are maliciouos, you might want to snoop them a little:
You can find out what files they have open like this (example for one of the process IDs):
You can also connect to them with strace to see what system calls they are making, e.g.:
If you want to grep the output of strace, you need to re-direct stderr to stdout first, e.g.
Code:
strace -p 7266 2>&1 |grep ^open
You might also want to see if these processes are connected to any remote hosts:
Code:
netstat -p |grep perl
You can also get a load of information out of the /proc/7266 area. Looking in the environ can be interesting. cmdline might tell you what the script's file is, but it also might not, depending on how the script was invoked.