.so files in ReadyNAS NV+ root

[JanHi]

Hi there,

Well stuff has changed around here. The old link brought in a new home. Looks good here. Nice.

Still running my ReadyNAS NV+ to the max. Still working fine. Update the firmware and stuff last week. But I noticed new files popping up in the root of the NAS. They have the extention .so. I think they are related to the new update, but just want to make sure.

Content of  the files are similar to the text below. 

=======================

__gmon_start__ _init _fini _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize _Jv_RegisterClasses
loop_pipe fork exit dup2 close execvp wait spawn_reverse_shell htons inet_addr socket connect execve getppid umask setsid
chdir samba_init_module puts change_to_root_user libc.so.6 _edata __bss_start _end GLIBC_2.2.5

GCC: (Debian 4.9.2-10) 4.9.2 .symtab .strtab .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r
.rela.dyn .rela.plt .init .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss .comment

crtstuff.c __JCR_LIST__ deregister_tm_clones register_tm_clones __do_global_dtors_aux completed.6661 __do_global_dtors_aux_fini_array_entry frame_dummy
__frame_dummy_init_array_entry implant.c detach_from_parent __FRAME_END__ __JCR_END__ __dso_handle _DYNAMIC __TMC_END__ _GLOBAL_OFFSET_TABLE_
_ITM_deregisterTMCloneTable puts@@GLIBC_2.2.5 loop_pipe spawn_reverse_shell _edata _fini chdir@@GLIBC_2.2.5 htons@@GLIBC_2.2.5 dup2@@GLIBC_2.2.5
close@@GLIBC_2.2.5 pipe@@GLIBC_2.2.5 setsid@@GLIBC_2.2.5 execve@@GLIBC_2.2.5 inet_addr@@GLIBC_2.2.5 __gmon_start__ umask@@GLIBC_2.2.5 samba_init_module
change_to_root_user _end __bss_start _Jv_RegisterClasses execvp@@GLIBC_2.2.5 getppid@@GLIBC_2.2.5 exit@@GLIBC_2.2.5 connect@@GLIBC_2.2.5
_ITM_registerTMCloneTable wait@@GLIBC_2.2.5 __cxa_finalize@@GLIBC_2.2.5 _init fork@@GLIBC_2.2.5 socket@@GLIBC_2.2.5

=======================

Thanks in advance.

Cheers, Jan.

[JennC · Accepted solution]

Hello JanHi,

.so file is a compiled library file. It stands for "Shared Object" which is equivalent to Windows' .dll file. So, it could be, I think, a file that contains your logins to add-ons of your NAS which I think you should keep and will not harm your system and files.

Welcome to the community!

Regards,

[mdgm-ntgr]

Any add-ons installed? Do you forward ports to your NAS?

[JanHi]

Hi mdgm,

Had ReadyNAS Remote active, but it is overdue. Not using it anymore. Other than that, pretty vanilla.

[JennC · Accepted solution]

Hello JanHi,

.so file is a compiled library file. It stands for "Shared Object" which is equivalent to Windows' .dll file. So, it could be, I think, a file that contains your logins to add-ons of your NAS which I think you should keep and will not harm your system and files.

Welcome to the community!

Regards,

[JanHi]

Hi JennC,

Sound very plausible. I think I saw it pop up when the new firmware was installed. But at the same time Windows had an update as well, as did my security package. Therefore the doubt on the file.

We'll leave it and see what happens.

Thanks for the support. Appreciated.

Regards,

Jan.