Date: Fri, 19 Oct 2007 11:41:13 +0100 From: Alex Zbyslaw <xfb52@dial.pipex.com> To: freebsd-questions Questions <freebsd-questions@freebsd.org> Subject: Re: Strange perl script Message-ID: <471889C9.8030709@dial.pipex.com> In-Reply-To: <20071018174706.GA28392@demeter.hydra> References: <005801c8107c$8b7b93a0$0202fea9@jarasoft.net> <20071017151607.GB51123@gizmo.acns.msu.edu> <002101c810f9$10379b80$0202fea9@jarasoft.net> <2850867d4a18dfbe5eb8e9586c114af0@gmail.com> <20071018174706.GA28392@demeter.hydra>
next in thread | previous in thread | raw e-mail | index | archive | help
Chad Perrin wrote: > then updatedb and locate sploger so you're using As was pointed out earlier in the thread, you can easily delete a file after running it, so whatever was running may not exist on the disk any more. Also, it is completely trivial to change the name shown by ps simply by changing the C equivalent of ARGV[0} which in perl is $0. Run the following and ps shows "rubbish (perl)" and not "foo.prl (perl)" foo.prl ------- #!/usr/bin/env perl $0="rubbish"; sleep 120; $ chmod +x foo.prl $ ./foo.prl & $ ps 7274 p1 S 0:00.00 rubbish (perl) bar.prl ------- #!/usr/bin/env perl sleep 120; $ perl bar.prl & $ ps 7575 p1 S 0:00.00 perl ./bar.prl If sploger really was malware, then it was probably picking some name at random to show in ps. The difference between the ps outputs when changing $0 hints at that, but I haven't done exhaustive tests. --Alex
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?471889C9.8030709>