X-Recipient: archive-cygwin@delorie.com X-Spam-Check-By: sourceware.org Date: Sun, 12 Dec 2010 14:59:51 -0500 From: Christopher Faylor To: cygwin@cygwin.com Subject: Re: Fwd: Suspicious EXE named "[.exe" in c:\cygwin\bin? Message-ID: <20101212195951.GH14369@ednor.casa.cgf.cx> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20101212171536.GB14369@ednor.casa.cgf.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com On Sun, Dec 12, 2010 at 12:26:54PM -0500, Jeffrey Walton wrote: >On Sun, Dec 12, 2010 at 12:15 PM, Christopher Faylor wrote: >> On Sun, Dec 12, 2010 at 11:53:28AM -0500, Jeffrey Walton wrote: >>>2nd try. >> >> The input is sanitized. >Hmm.... > >> It is not a database and it is not PHP. >My bad CGI then... > >> >> The "Internal Server Error" just means that the search took too long and >> that is likely because someone has been attempting a DDOS on >> sourceware.org for a couple of weeks. > >Nope, no DDOS. Just a simple 1= 1. You weren't being accused of issuing a DDOS. sourceware.org has been subjected to several attacks in the last few weeks and it has caused things to randomly slow down. >Are you sure it does not mean the error was due to using too much >memory when joining tables (or something similar)? Otherwise, I would >expect a 4xx error due to a bad client request. You mean tables in the nonexistent database? Yes, I'm extremely sure. >> And, the "[.exe" program is really supposed to be there. >Thanks. It looked very suspicious. > >> Since this is a regex search, the search term would be \[\.exe >OK. Thanks. > >> If you have further questions please use the cygwin mailing list. >OK. The Internal Server Error 500 page stated to use >sourcemaster AT The error message is a one-size-fits-all for sourceware.org, which is why you were told to send further questions here. However, since you are reporting 1) a nonissue and 2) a known issue, after 14 messages from you on the subject, I think there really is no reason to discuss this further. cgf -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple