X-Recipient: archive-cygwin@delorie.com X-SWARE-Spam-Status: No, hits=1.6 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,KAM_THEBAT X-Spam-Check-By: sourceware.org Date: Wed, 29 Feb 2012 16:22:53 +0400 From: Andrey Repin Reply-To: Andrey Repin Message-ID: <835563459.20120229162253@mtu-net.ru> To: Corinna Vinschen Subject: Re: BLODA detection code in latest snapshot In-Reply-To: <20120229085527.GO23440@calimero.vinschen.de> References: <20120227122614.GB31025@calimero.vinschen.de> <4F4C41B5.7040804@acm.org> <4F4C51D0.70307@acm.org> <20120228094024.GD23052@calimero.vinschen.de> <16210489654.20120229024137@mtu-net.ru> <20120229085527.GO23440@calimero.vinschen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-IsSubscribed: yes Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com Greetings, Corinna Vinschen! >> > Yup, confirmed. This occurs on W7/32 as well. >> > I add shlwapi to the list of filtered DLLs for which no such message is printed. >> >> Could you please consider making such list configurable, if it's not much of >> an issue? >> This feature seems to be the reasonable way for rough detection of potentially >> malicious presence, but I would like to avoid certain handlers to be reported, >> such as antivirus' LSP or keyboard hotkey handler. > Hmm. Well, this option isn't meant to be used all the time. It's not > overly intrusive, but it costs time and Cygwin already isn't exactly > fast. For a pure diagnosing tool, does it makes sense to add lots > of configuration options? No, it doesn't. I've asked "just in cause" :) > If you want to make the DLL list configurable, what's your idea? Another > env var like, say CYGWIN_DETECT_BLODA_DLL_IGNORE_LIST? Registry key (REG_MULTI_SZ) would be better. Speaking of which (a list of potentially intrusive DLL's) - do you filter by DLL name or it's full path? Because, %SystemRoot%\system32\shlwapi.dll is likely to be harmless. But same name DLL inserted from any other place... -- WBR, Andrey Repin (anrdaemon@freemail.ru) 29.02.2012, <16:09> Sorry for my terrible english... -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple