Win32.FunTime.d virus in cygwin1.dll

Win32.FunTime.d virus in cygwin1.dll

[Powell, Walt - TOP]

Gentlemen:

Our sysop has informed me that the file cygwin1.dll contains a virus called
the Win32.FunTime.d.

I obtained this file from the gzipped file egcs-1.1.1-cygb20.tar.gz,
obtained from an earlier cygwin download. As far as I can tell, cygwin1.dll
has not been altered at my site, and if this is true, the virus must have
originated at the cygnus site.  

I am deeply concerned about this possibility.  Can you provide any
information or a secure version of cygwin1.dll?

Sincerely,


Walter Powell
Electrical Engineer (Consultant)
Daytime Phone: 360-418-8810
             FAX:    360-418-8446
             Pager:  503-514-5951
Mail Stop        : TOP/DITT2

Re: Win32.FunTime.d virus in cygwin1.dll

[Chris Faylor]

On Tue, Apr 11, 2000 at 09:38:04AM -0700, Powell, Walt - TOP wrote:
>Our sysop has informed me that the file cygwin1.dll contains a virus called
>the Win32.FunTime.d.
>
>I obtained this file from the gzipped file egcs-1.1.1-cygb20.tar.gz,
>obtained from an earlier cygwin download. As far as I can tell, cygwin1.dll
>has not been altered at my site, and if this is true, the virus must have
>originated at the cygnus site.  
>
>I am deeply concerned about this possibility.  Can you provide any
>information or a secure version of cygwin1.dll?

I am not sure why you are sending email to the insight mailing list concerning
a DLL that you extracted from an EGCS tar file downloaded from a non-cygnus
web site.

However, we receive false alarms about this on a regular basis.  There is
one virus-checking package which returns a fals positive on the Cygwin DLL.
That is not to say that it is impossible that your DLL is infected.  I
would try testing it with multiple virus checking packages.  If they all agree
then you probably do have an infected DLL.  You can find a new DLL to download
at http://sourceware.cygnus.com/cygwin/ .

Christopher Faylor
Cygwin Engineering Manager
Cygnus Solutions, a Red Hat company