public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
* Norton antivirus detects a threat in setup-x86_64.exe
@ 2017-12-20 21:01 Greg Taylor
  2017-12-20 21:56 ` Lee
  2017-12-20 22:22 ` Sean Murphy
  0 siblings, 2 replies; 6+ messages in thread
From: Greg Taylor @ 2017-12-20 21:01 UTC (permalink / raw)
  To: cygwin

On 12/20/17 @ 12;20pm PST I downloaded the most recent version of
setup-x86_64.exe which was flagged as a threat by Norton Antivirus.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Norton antivirus detects a threat in setup-x86_64.exe
  2017-12-20 21:01 Norton antivirus detects a threat in setup-x86_64.exe Greg Taylor
@ 2017-12-20 21:56 ` Lee
  2017-12-20 22:22 ` Sean Murphy
  1 sibling, 0 replies; 6+ messages in thread
From: Lee @ 2017-12-20 21:56 UTC (permalink / raw)
  To: cygwin

On 12/20/17, Greg Taylor   wrote:
> On 12/20/17 @ 12;20pm PST I downloaded the most recent version of
> setup-x86_64.exe which was flagged as a threat by Norton Antivirus.

What does https://www.virustotal.com say about the file?  (I get 0/67
- all clean)

You can also download https://cygwin.com/setup-x86_64.exe.sig
& do  gpg --verify setup-x86_64.exe.sig
hopefully you get something along the lines of
gpg: Signature made Mon, Dec 11, 2017  1:36:32 PM EST
gpg:                using DSA key 0xA9A262FF676041BA
gpg: Good signature from "Cygwin <cygwin@cygwin.com>"

Lee

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Norton antivirus detects a threat in setup-x86_64.exe
  2017-12-20 21:01 Norton antivirus detects a threat in setup-x86_64.exe Greg Taylor
  2017-12-20 21:56 ` Lee
@ 2017-12-20 22:22 ` Sean Murphy
  2017-12-20 22:50   ` Vijaya Subramanian via cygwin
  1 sibling, 1 reply; 6+ messages in thread
From: Sean Murphy @ 2017-12-20 22:22 UTC (permalink / raw)
  To: cygwin

On Wed, Dec 20, 2017 at 3:38 PM, Greg Taylor <greg.k.taylor@gmail.com> wrote:
> On 12/20/17 @ 12;20pm PST I downloaded the most recent version of
> setup-x86_64.exe which was flagged as a threat by Norton Antivirus.

It means Norton's heuristics jump the gun about Cygwin's setup.  I
encountered this quite a few times in the past before I stopped using
Norton.

You have to go into Norton's settings and whitelist it as a trusted application.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Norton antivirus detects a threat in setup-x86_64.exe
  2017-12-20 22:22 ` Sean Murphy
@ 2017-12-20 22:50   ` Vijaya Subramanian via cygwin
  2017-12-20 23:13     ` Greg Taylor
  0 siblings, 1 reply; 6+ messages in thread
From: Vijaya Subramanian via cygwin @ 2017-12-20 22:50 UTC (permalink / raw)
  To: cygwin, Sean Murphy

Just tell Norton you trust the application-it will say too few users but also give you the option to say you trust the app.
 

    On Wednesday, December 20, 2017, 2:44:33 PM MST, Sean Murphy <s.pat.murph@gmail.com> wrote:  
 
 On Wed, Dec 20, 2017 at 3:38 PM, Greg Taylor <greg.k.taylor@gmail.com> wrote:
> On 12/20/17 @ 12;20pm PST I downloaded the most recent version of
> setup-x86_64.exe which was flagged as a threat by Norton Antivirus.

It means Norton's heuristics jump the gun about Cygwin's setup.  I
encountered this quite a few times in the past before I stopped using
Norton.

You have to go into Norton's settings and whitelist it as a trusted application.

--
Problem reports:      http://cygwin.com/problems.html
FAQ:                  http://cygwin.com/faq/
Documentation:        http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

  
--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Norton antivirus detects a threat in setup-x86_64.exe
  2017-12-20 22:50   ` Vijaya Subramanian via cygwin
@ 2017-12-20 23:13     ` Greg Taylor
  2017-12-21  0:09       ` Greg Taylor
  0 siblings, 1 reply; 6+ messages in thread
From: Greg Taylor @ 2017-12-20 23:13 UTC (permalink / raw)
  To: Vijaya Subramanian, cygwin

I downloaded the file setup-x86_64.exe again and now the scan reports no
threats.

Version 2.882 was all clear
Version 2.883 downloaded at 12:30pm reported a threat
Version 2.883 downloaded at 2:14pm PST was all clear

I looked in the logs and there was a WS.Reputation.1 risk which is
essentially a crowd sourced threat level.

The following URL explains this type of warning:
https://community.norton.com/en/forums/clarification-wsreputation1-detection



On Wed, Dec 20, 2017 at 1:56 PM, Vijaya Subramanian via cygwin <
cygwin@cygwin.com> wrote:

> Just tell Norton you trust the application-it will say too few users but
> also give you the option to say you trust the app.
>
>
>     On Wednesday, December 20, 2017, 2:44:33 PM MST, Sean Murphy <
> s.pat.murph@gmail.com> wrote:
>
>  On Wed, Dec 20, 2017 at 3:38 PM, Greg Taylor <greg.k.taylor@gmail.com>
> wrote:
> > On 12/20/17 @ 12;20pm PST I downloaded the most recent version of
> > setup-x86_64.exe which was flagged as a threat by Norton Antivirus.
>
> It means Norton's heuristics jump the gun about Cygwin's setup.  I
> encountered this quite a few times in the past before I stopped using
> Norton.
>
> You have to go into Norton's settings and whitelist it as a trusted
> application.
>
> --
> Problem reports:      http://cygwin.com/problems.html
> FAQ:                  http://cygwin.com/faq/
> Documentation:        http://cygwin.com/docs.html
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>
>
> --
> Problem reports:       http://cygwin.com/problems.html
> FAQ:                   http://cygwin.com/faq/
> Documentation:         http://cygwin.com/docs.html
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Norton antivirus detects a threat in setup-x86_64.exe
  2017-12-20 23:13     ` Greg Taylor
@ 2017-12-21  0:09       ` Greg Taylor
  0 siblings, 0 replies; 6+ messages in thread
From: Greg Taylor @ 2017-12-21  0:09 UTC (permalink / raw)
  To: cygwin

On Wed, Dec 20, 2017 at 2:22 PM, Greg Taylor <greg.k.taylor@gmail.com>
wrote:

> I downloaded the file setup-x86_64.exe again and now the scan reports no
> threats.
>
> Version 2.882 was all clear
> Version 2.883 downloaded at 12:30pm reported a threat
> Version 2.883 downloaded at 2:14pm PST was all clear
>

To clear up the issue (if there are any lingering doubts about the 12:30
file), the md5 sum of the files from 12:30 and 2:14 are identical.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2017-12-20 23:35 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-20 21:01 Norton antivirus detects a threat in setup-x86_64.exe Greg Taylor
2017-12-20 21:56 ` Lee
2017-12-20 22:22 ` Sean Murphy
2017-12-20 22:50   ` Vijaya Subramanian via cygwin
2017-12-20 23:13     ` Greg Taylor
2017-12-21  0:09       ` Greg Taylor

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).