X-Recipient: archive-cygwin@delorie.com X-SWARE-Spam-Status: No, hits=-2.1 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,T_TO_NO_BRKTS_FREEMAIL X-Spam-Check-By: sourceware.org MIME-Version: 1.0 Reply-To: noloader@gmail.com In-Reply-To: <20101212171536.GB14369@ednor.casa.cgf.cx> References: <20101212171536.GB14369@ednor.casa.cgf.cx> Date: Sun, 12 Dec 2010 12:26:54 -0500 Message-ID: Subject: Re: Fwd: Suspicious EXE named "[.exe" in c:\cygwin\bin? From: Jeffrey Walton To: cygwin@cygwin.com Content-Type: text/plain; charset=ISO-8859-1 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com On Sun, Dec 12, 2010 at 12:15 PM, Christopher Faylor wrote: > On Sun, Dec 12, 2010 at 11:53:28AM -0500, Jeffrey Walton wrote: >>2nd try. > > The input is sanitized. Hmm.... > It is not a database and it is not PHP. My bad CGI then... > > The "Internal Server Error" just means that the search took too long and > that is likely because someone has been attempting a DDOS on > sourceware.org for a couple of weeks. Nope, no DDOS. Just a simple 1= 1. Are you sure it does not mean the error was due to using too much memory when joining tables (or something similar)? Otherwise, I would expect a 4xx error due to a bad client request. > > And, the "[.exe" program is really supposed to be there. Thanks. It looked very suspicious. > Since this is a regex search, the search term would be \[\.exe OK. Thanks. > If you have further questions please use the cygwin mailing list. OK. The Internal Server Error 500 page stated to use sourcemaster@sourceware.org. Jeff -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple