Strange code, dont know what does it do?

mingle

Hi, I have a .pm file, which was placed within my site when it got hacked, i've never used perl before, but after some googling I thought I'd ask the pros at these forums.


Heres the code which is encoded, i believe?


Can someone decode it and tell me if its harmful or what its doing? Or perhaps tell me how to decode it, i guess i can remove it but i need to know to prevent further damage in the future.

Thank You.

Oct 3 '09 #1

numberwhun

First, if you were hacked and this was placed on your system, I would certainly consider it harmful until determined otherwise.

Second, I don't know how it is encoded, but I think we would need to see a copy of the WSD::filter module that it references, as it is not in CPAN which again eludes to the bad nature of this module.

I would highly recommend you move these to another location, outside of your Perl @INC path, rename them, and then study them to find out what they do. I really want to see the WSD::filter module if you can please.

Regards,

Jeff

Oct 4 '09 #2

mingle

Thanks for the swift reply, Jeff.

Attached are the WSD Filter modules it refers to.

Oct 4 '09 #3

numberwhun

If you look at that, it is basically setting things up and then calling one of the binary .so files. Because they are binary, there is no way to know what they do (and I am NOT going to run them, sorry).

My suggestions are:

1. Get rid of this module.
2. It calls a module called DynaLoader. If that is something you need, fine, if not, remove it as well.
3. I would seriously considering hardening my system and locking it down so this doesn't happen again. (Yes, that would include changing any and all root passwords.

Regards,

Jeff

Oct 5 '09 #4

chorny

@numberwhun
Removing DynaLoader is not a good idea. Many XS-based modules use it. It is a core module and it is not on CPAN, so most modules do not declare dependency on it. For ex., DBI uses it.

Oct 18 '09 #5

numberwhun

@chorny
First, you are right. I didn't think about the fact that it was a core module. But, you are wrong, it is on CPAN. If its in the core, it is definitely on CPAN.

Oct 18 '09 #6