public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
* Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe
@ 2002-04-30 23:16 Gianni Mariani
  2002-05-02  7:35 ` Elmar Haneke
  0 siblings, 1 reply; 5+ messages in thread
From: Gianni Mariani @ 2002-04-30 23:16 UTC (permalink / raw)
  To: cygwin


I have some reasons to suspect that http://cygwin.com/setup.exe is 
infected with a virus that Norton and McAfree don't scan. well, 
sometimes they say it's Cles or Wez or somthing.

Or it could be that it's a coincidence that as soon as I asked other 
developers to install cywin they all got it as well, and it may also be 
just a coincidence that after installing a fresh copy of everything and 
rebooted and all was *almost* fine (because some commands -like ls.exe- 
didn't install), but my machine instantly rebooted when I tried to run 
the cygwin setup the second time.

I really am not sure but I encourage everyone to make sure that I'm wrong.

This is the md5 of the setup.exe I downloaded.

616c0f35c0abf14d00a82a7bea1f1b2c  setup.exe

I really hope this is a false alarm but it's too coincidental to not 
bring to some-one's attention.

G




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe
  2002-04-30 23:16 Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe Gianni Mariani
@ 2002-05-02  7:35 ` Elmar Haneke
  2002-05-02 11:04   ` Winston Gutkowski
  0 siblings, 1 reply; 5+ messages in thread
From: Elmar Haneke @ 2002-05-02  7:35 UTC (permalink / raw)
  To: cygwin



Gianni Mariani schrieb::

> I have some reasons to suspect that http://cygwin.com/setup.exe is 
> infected with a virus that Norton and McAfree don't scan. well, 
> sometimes they say it's Cles or Wez or somthing.
> This is the md5 of the setup.exe I downloaded.
> 
> 616c0f35c0abf14d00a82a7bea1f1b2c  setup.exe
> 
> I really hope this is a false alarm but it's too coincidental to not 
> bring to some-one's attention.

I did download the same file, f-prot an AntiVir did not find anything 
suspect. You should send the file the the vendors of yor AV-Software, 
the should fix their scan-engine.

Elmar




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

^ permalink raw reply	[flat|nested] 5+ messages in thread

* RE: Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe
  2002-05-02  7:35 ` Elmar Haneke
@ 2002-05-02 11:04   ` Winston Gutkowski
  2002-05-02 12:01     ` Michael A Chase
  2002-05-02 15:50     ` Larry Hall (RFK Partners, Inc)
  0 siblings, 2 replies; 5+ messages in thread
From: Winston Gutkowski @ 2002-05-02 11:04 UTC (permalink / raw)
  To: Cygwin

Can anyone confirm or deny this? Both products mentioned are reputable virus
checkers, so it would be nice to get some official feedback on the
situation.

Thanks

Winston Gutkowski

> -----Original Message-----
> From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com]On Behalf
> Of Elmar Haneke
> Sent: Thursday, May 02, 2002 7:36
> To: cygwin@cygwin.com
> Subject: Re: Not to alarm anyone - but possible virus on
> http://cygwin.com/setup.exe
>
>
>
>
> Gianni Mariani schrieb::
>
> > I have some reasons to suspect that http://cygwin.com/setup.exe is
> > infected with a virus that Norton and McAfree don't scan. well,
> > sometimes they say it's Cles or Wez or somthing.
> > This is the md5 of the setup.exe I downloaded.
> >
> > 616c0f35c0abf14d00a82a7bea1f1b2c  setup.exe
> >
> > I really hope this is a false alarm but it's too coincidental to not
> > bring to some-one's attention.
>
> I did download the same file, f-prot an AntiVir did not find anything
> suspect. You should send the file the the vendors of yor AV-Software,
> the should fix their scan-engine.
>
> Elmar
>
>
>
>
> --
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
> Bug reporting:         http://cygwin.com/bugs.html
> Documentation:         http://cygwin.com/docs.html
> FAQ:                   http://cygwin.com/faq/
>
>


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe
  2002-05-02 11:04   ` Winston Gutkowski
@ 2002-05-02 12:01     ` Michael A Chase
  2002-05-02 15:50     ` Larry Hall (RFK Partners, Inc)
  1 sibling, 0 replies; 5+ messages in thread
From: Michael A Chase @ 2002-05-02 12:01 UTC (permalink / raw)
  To: Winston Gutkowski, Cygwin

On Thu, 2 May 2002 11:04:06 -0700 Winston Gutkowski <winston.gutkowski@eztext.com> wrote:

> Can anyone confirm or deny this? Both products mentioned are reputable virus
> checkers, so it would be nice to get some official feedback on the situation.

To date, every alarm about setup.exe has been either an invalid test by the
anti-virus software or a virus infection spread by some other means.  Send
your 'infected' copy to your anti-virus vendor if you want official
feedback __just as Elmar suggested__.

Just to be certain, I confirmed my Norton Anti-Virus is completely up to
date, downloaded a fresh copy of setup.exe, and scanned it.  It was clean. 
The way setup.exe is created and distributed makes infection at Redhat
(cygwin.com) or one of the mirrors unlikely.

Since Klez is normally spread by people opening email attachments, you
should check if you have all received similar emails recently.  A full
system virus scan would be prudent on all potentially affected systems.

> > -----Original Message-----
> > From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com]On Behalf
> > Of Elmar Haneke
> > Sent: Thursday, May 02, 2002 7:36
> > To: cygwin@cygwin.com
> > Subject: Re: Not to alarm anyone - but possible virus on
> > http://cygwin.com/setup.exe

> > Gianni Mariani schrieb::
> >
> > > I have some reasons to suspect that http://cygwin.com/setup.exe is
> > > infected with a virus that Norton and McAfree don't scan. well,
> > > sometimes they say it's Cles or Wez or somthing.
> > > This is the md5 of the setup.exe I downloaded.
> > >
> > > 616c0f35c0abf14d00a82a7bea1f1b2c  setup.exe
> > >
> > > I really hope this is a false alarm but it's too coincidental to not
> > > bring to some-one's attention.
> >
> > I did download the same file, f-prot an AntiVir did not find anything
> > suspect. You should send the file the the vendors of yor AV-Software,
> > the should fix their scan-engine.

-- 
Mac :})
** I normally forward private questions to the appropriate mail list. **
Ask Smarter: http://www.tuxedo.org/~esr/faqs/smart-questions.html
Give a hobbit a fish and he eats fish for a day.
Give a hobbit a ring and he eats fish for an age.



--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

^ permalink raw reply	[flat|nested] 5+ messages in thread

* RE: Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe
  2002-05-02 11:04   ` Winston Gutkowski
  2002-05-02 12:01     ` Michael A Chase
@ 2002-05-02 15:50     ` Larry Hall (RFK Partners, Inc)
  1 sibling, 0 replies; 5+ messages in thread
From: Larry Hall (RFK Partners, Inc) @ 2002-05-02 15:50 UTC (permalink / raw)
  To: Winston Gutkowski, Cygwin

There is no virus in setup.exe as distributed by Cygwin.  I think there's been
enough reports on this list to confirm that this is the case.

Larry Hall                              lhall@rfk.com
RFK Partners, Inc.                      http://www.rfk.com
838 Washington Street                   (508) 893-9779 - RFK Office
Holliston, MA 01746                     (508) 893-9889 - FAX

At 02:04 PM 5/2/2002, Winston Gutkowski wrote:
>Can anyone confirm or deny this? Both products mentioned are reputable virus
>checkers, so it would be nice to get some official feedback on the
>situation.
>
>Thanks
>
>Winston Gutkowski
>
> > -----Original Message-----
> > From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com]On Behalf
> > Of Elmar Haneke
> > Sent: Thursday, May 02, 2002 7:36
> > To: cygwin@cygwin.com
> > Subject: Re: Not to alarm anyone - but possible virus on
> > http://cygwin.com/setup.exe
> >
> >
> >
> >
> > Gianni Mariani schrieb::
> >
> > > I have some reasons to suspect that http://cygwin.com/setup.exe is
> > > infected with a virus that Norton and McAfree don't scan. well,
> > > sometimes they say it's Cles or Wez or somthing.
> > > This is the md5 of the setup.exe I downloaded.
> > >
> > > 616c0f35c0abf14d00a82a7bea1f1b2c  setup.exe
> > >
> > > I really hope this is a false alarm but it's too coincidental to not
> > > bring to some-one's attention.
> >
> > I did download the same file, f-prot an AntiVir did not find anything
> > suspect. You should send the file the the vendors of yor AV-Software,
> > the should fix their scan-engine.
> >
> > Elmar
> >
> >
> >
> >
> > --
> > Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
> > Bug reporting:         http://cygwin.com/bugs.html
> > Documentation:         http://cygwin.com/docs.html
> > FAQ:                   http://cygwin.com/faq/
> >
> >
>
>
>--
>Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>Bug reporting:         http://cygwin.com/bugs.html
>Documentation:         http://cygwin.com/docs.html
>FAQ:                   http://cygwin.com/faq/


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2002-05-02 22:50 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-04-30 23:16 Not to alarm anyone - but possible virus on http://cygwin.com/setup.exe Gianni Mariani
2002-05-02  7:35 ` Elmar Haneke
2002-05-02 11:04   ` Winston Gutkowski
2002-05-02 12:01     ` Michael A Chase
2002-05-02 15:50     ` Larry Hall (RFK Partners, Inc)

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).