Mailing-List:	contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT sourceware DOT cygnus DOT com>
List-Archive:	<http://sourceware.cygnus.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT sourceware DOT cygnus DOT com>
List-Help:	<mailto:cygwin-help AT sourceware DOT cygnus DOT com>, <http://sourceware.cygnus.com/ml/#faqs>
Sender:	cygwin-owner AT sourceware DOT cygnus DOT com
Delivered-To:	mailing list cygwin AT sourceware DOT cygnus DOT com
Date:	Wed, 15 Dec 1999 20:42:45 -0500
Message-Id:	<199912160142.UAA26491@envy.delorie.com>
From:	DJ Delorie <dj AT delorie DOT com>
To:	cygwin AT sourceware DOT cygnus DOT com
Subject:	not a virus

I've started getting reports about a new "virus" being detected in the
age-old B20.1 release.  I've re-tested (again) the B20.1 "full.exe"
with the latest McAfee database, and it says it's clean.  The reported
virus is "Win32/Video.25600.Worm" and the reported file is "wc.exe".
This is only detected (so far) by the latest database for Inoculan,
from which we've had false positives before.

So, if you're using Inoculan, and you update your signature database,
and *suddenly* wc.exe seems infected, please double-check with a
different scanner to see if it's really infected or if it's a false
positive.  If a second scanner says it's infected, and you've verified
that the infection came from our full.exe (rather than from some other
infected file on your system), by all means let me know.

Of course, you should still take all suitable precautions in case it's
a real infection.

About the Win32/Video.25600.Worm virus:

* I found this: http://altavista.remarq.com/altavista/transcript.asp?g=Win32%2FVideo%2E25600%2EWorm&tn=18000000&sh=01da28e1777c70f5&str=Win32%2FVideo%2E25600%2EWorm&idx=0

* Look for C:\Zip01.exe, which (apparently) is where the virus puts
  itself.

DJ

--
Want to unsubscribe from this list?
Send a message to cygwin-unsubscribe AT sourceware DOT cygnus DOT com

- Raw text -