From: Peter Buckley <peter.buckley@cportcorp.com>
To: "Larry Hall (RFK Partners, Inc)" <lhall@rfk.com>
Cc: cygwin@cygwin.com
Subject: Re: anybody else also infected
Date: Thu, 14 Feb 2002 07:13:00 -0000 [thread overview]
Message-ID: <3C6BD3F7.5080606@cportcorp.com> (raw)
In-Reply-To: <4.3.1.2.20020214094510.01ea0710@pop.ma.ultranet.com>
I think we do read the faq differently- when it says "antivirus programs
have been known to report false positives when extracting compressed tar
archives" and "consider disabling your anti-virus software when running
SETUP", I don't associate that with getting a false positive when *not*
running setup, or when *not* extracting compressed tar archives.
The directions in the next questions "My computer hangs when I try to
run setup.exe" would not have avoided this type of false positive-
namely when the realtime scanning pops up and quarantines a dll whenever
it is run. I am in favor of a more general faq in light of this *new*
development and *new* type of false positive- I don't know what the
chances are of this happening in the future, but I would put it in the
faq as a note, "NAV has had false positives in the past on cygwin dlls,
please remain calm with your seatbelts fastened".
I agree about the healthy skepticism- this was obviously a false
positive from the very start, but I don't think the faq addresses this
type of false positive.
-Peter
Larry Hall (RFK Partners, Inc) wrote:
> OK, perhaps you and I read the FAQ differently. I read it to indicate that
> you should assume that any reported infection from Cygwin files are false
> until you can determine otherwise. To me, it's worthwhile to inform the
> list of viruses in any Cygwin related software if the virus is real. However,
> allot of posts about the potential of a virus isn't really helpful to anyone
> and can lead newbies to panic, adding to the list volume. Personally, I've
> never seen a single confirmed virus in any Cygwin software in the more than
> 6 years I've been using it, though I've seen many a report of viruses (hence
> the FAQ entry about them). So I view all Cygwin virus reports on this list
> with a bit of healthy skepticism, unless there is evidence to support doing
> otherwise. I'm just suggesting that others take that message to heart and
> do their homework before posting.
>
> Now back to my own little utopia where everything is done right. ;-)
>
> Larry Hall lhall@rfk.com
> RFK Partners, Inc. http://www.rfk.com
> 838 Washington Street (508) 893-9779 - RFK Office
> Holliston, MA 01746 (508) 893-9889 - FAX
>
>
>
> At 09:35 AM 2/14/2002, Peter Buckley wrote:
>
>>I don't think that faq would have avoided or truncated this thread. It seems related, but it is in fact different.
>>
>>If someone followed the instructions in the faq, they would have had a false positive reported on cygz.dll. Whenever the cygz.dll file was called (say, by invoking cygcheck), the real-time scanning of NAV popped up with "cygz.dll is infected with backdoor.egghead, and has been quarantined".
>>
>>Maybe an addition to that faq needs to be made, that some antivirus programs (specifically symantec) have had false positives on cygwin dlls.
>>
>>Just as an FYI, this same false positive for backdoor.egghead was seen on the cygwin1.dll from the 1.3.2-1 distribution.
>>
>>-Peter
>>
>>Larry Hall (RFK Partners, Inc) wrote:
>>
>>
>>>Hm, it seems like this entire thread could have been avoided or at least
>>>truncated by a simple visit to the FAQ:
>>>Is setup.exe, or one of the packages, infected with a virus?
>>>http://cygwin.com/faq/faq_2.html#SEC11
>>>Larry Hall lhall@rfk.com
>>>RFK Partners, Inc. http://www.rfk.com
>>>838 Washington Street (508) 893-9779 - RFK Office
>>>Holliston, MA 01746 (508) 893-9889 - FAX
>>>
>>>At 08:39 AM 2/14/2002, hongxun lee wrote:
>>>
>>>
>>>>Sorry for the panic...My bet is all you can do is to update the package zlib
>>>>...
>>>>NAV this morning had released its new vir-definition..Thanks
>>>>
>>>>----- Original Message -----
>>>>From: "KAMDAR,NILESH (A-Sonoma,ex1)" <nilesh_kamdar2@agilent.com>
>>>>To: <lee.1801@osu.edu>
>>>>Sent: Wednesday, February 13, 2002 10:58 PM
>>>>Subject: anybody else also infected
>>>>
>>>>
>>>>
>>>>
>>>>>Hello Hongxun Lee,
>>>>>
>>>>>(I am not on the mailing list of cygwin so I am emailing directly to you)
>>>>>
>>>>>I have the same problem. My cygwin1.dll and cygz.dll file are in
>>>>>
>>>>quarantine.
>>>>
>>>>
>>>>>NAV claims that they are infected with the BAckdoor.Egghead virus but I
>>>>>
>>>>dont
>>>>
>>>>
>>>>>see any other signs besides the above 2 files. I Think NAV definitions are
>>>>>wrong!!!!
>>>>>
>>>>>I actually have SEVERAL customers who are going to complain about this
>>>>>tomorrow. So I am trying to find a quick resolution. I have also posted my
>>>>>question to Symantec.
>>>>>
>>>>>I am hoping that Symantec sends out newer update virus definitions which
>>>>>
>>>>DO
>>>>
>>>>
>>>>>NOT cause this error.
>>>>>
>>>>>Let me know if you get any updates from them.
>>>>>
>>>>>Thanks.
>>>>>--Nilesh Kamdar
>>>>>
>>>>>
>>>>--
>>>>Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
>>>>Bug reporting: http://cygwin.com/bugs.html
>>>>Documentation: http://cygwin.com/docs.html
>>>>FAQ: http://cygwin.com/faq/
>>>>
>>>--
>>>Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
>>>Bug reporting: http://cygwin.com/bugs.html
>>>Documentation: http://cygwin.com/docs.html
>>>FAQ: http://cygwin.com/faq/
>>>
>>
>>--
>>1 Timothy 4:12 (NIV)- Don't let anyone look down on you because you are young, but set an example for the believers
>>in speech, in life, in love, in faith, and in purity.
>>
>>
>>--
>>Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
>>Bug reporting: http://cygwin.com/bugs.html
>>Documentation: http://cygwin.com/docs.html
>>FAQ: http://cygwin.com/faq/
>>
>
--
1 Timothy 4:12 (NIV)- Don't let anyone look down on you because you are
young, but set an example for the believers
in speech, in life, in love, in faith, and in purity.
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Bug reporting: http://cygwin.com/bugs.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
next prev parent reply other threads:[~2002-02-14 15:13 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <01A7DAF31F93D511AEE300D0B706ED92019ECD65@axcs13.cos.agilent.com>
2002-02-14 5:29 ` hongxun lee
2002-02-14 6:24 ` Larry Hall (RFK Partners, Inc)
2002-02-14 6:35 ` Peter Buckley
2002-02-14 7:02 ` Larry Hall (RFK Partners, Inc)
2002-02-14 7:13 ` Peter Buckley [this message]
2002-02-14 7:19 ` Larry Hall (RFK Partners, Inc)
2002-02-14 7:31 ` David Starks-Browning
2002-02-14 7:37 ` Christopher Faylor
2002-02-14 7:58 ` Larry Hall (RFK Partners, Inc)
2002-02-14 8:36 ` Christopher Faylor
2002-02-14 23:22 ` Gary R. Van Sickle
2002-02-14 7:47 ` Larry Hall (RFK Partners, Inc)
2002-02-14 7:37 ` Christopher Faylor
2002-02-14 12:38 Jerry Boonstra
-- strict thread matches above, loose matches on Subject: below --
2002-02-13 18:05 hongxun lee
2002-02-13 18:17 ` Randall R Schulz
2002-02-13 18:23 ` hongxun lee
2002-02-13 19:28 ` Michael A Chase
2002-02-13 20:18 ` Randall R Schulz
2002-02-13 21:02 ` Michael A Chase
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3C6BD3F7.5080606@cportcorp.com \
--to=peter.buckley@cportcorp.com \
--cc=cygwin@cygwin.com \
--cc=lhall@rfk.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).