DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=CPHl2n9
	GONN9JrsGtmfspnYp1EifAlh8uBfupNKijn/sVY9yju7KR4xKfUxzXUWwizyFHFc
	uaY9CGnUXUQgk52aSrIFP5TUrGbxcDW2IkwU+VSTGEbOiXUyLmMAEbFfs6jLtl9q
	JREtVhoMVcv80/oG8YAMqJw5JnXTNM8mHTRI=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
In-Reply-To: <20140515194537.GB1733@ednor.casa.cgf.cx>
References: <1400181948.68721.YahooMailNeo@web121901.mail.ne1.yahoo.com> <20140515193629.GA18612@tastycake.net> <20140515194537.GB1733@ednor.casa.cgf.cx>
From: Robert Pendell <shinji+cygwin@elite-systems.org>
Date: Thu, 15 May 2014 16:46:41 -0400
Message-ID: <CAAeCd-MSgepSPPt9i_750nUHSZ-ry0ttb5E14t-synzLyP1GVg@mail.gmail.com>
Subject: Re: setup-x86.exe has virus and is blocked by Malware Detectors
To: cygwin@cygwin.com
Content-Type: text/plain; charset=UTF-8

On Thu, May 15, 2014 at 3:45 PM, Christopher Faylor wrote:
> On Thu, May 15, 2014 at 08:36:29PM +0100, Adam Dinwoodie wrote:
>>On Thu, May 15, 2014 at 12:25:48PM -0700, Wes Kaefer wrote:
>>> I agree, it probably does not have a virus; but it has a virus signature.
>>
>>This is covered in the FAQ at http://cygwin.com/faq.html#faq.setup.virus
>
> Thanks for pointing that out.  I should have remembered the FAQ.
>
> cgf
>

It is actually flagging the fact that setup.exe is packed using upx
since at one point (or maybe still) virus authors had packed their
binaries with upx in order to try to evade scanners.  Upx in itself
though is not a virus and the false flag should probably be removed by
the antivirus company.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple