DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=kt77k5G
	yhJxrk1ORNXbp7gY5XVald9WfS9Abfd0TSLhjHiSVmYJVCMy/v7TD2vyegZrZaH7
	12AK2XttAzRqgDBpTO/Yq3YhEyo7V3+l3gsUd6Th8h60zlHaz8vMx+tCGNSJZL7v
	fLnilMKRgpYAqPS6dunzBbHfnws+sedDHiNg=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
In-Reply-To: <CAPXRkNFK=2b8Gjmb4ckCOXPGh_DFn6r2jRbxHMi3pNLn4cBSFg@mail.gmail.com>
References: <CAPXRkNH7QPGrSVtiwLvZ9ZF3rmEGy=Q4R3VxwY=JU0SBZVZH+A@mail.gmail.com> <CACoZoo12-507_9K7cFQm8DsCOKNF1dzWesMFF=+c1j=JrANY0g@mail.gmail.com> <CAPXRkNFK=2b8Gjmb4ckCOXPGh_DFn6r2jRbxHMi3pNLn4cBSFg@mail.gmail.com>
From: Erik Soderquist <ErikSoderquist@gmail.com>
Date: Wed, 28 Jun 2017 12:58:03 -0400
Message-ID: <CACoZoo1zYx-k0jpObPnqSs=f0Wnqgr=di+j8oZ4Ni2Z=KE_obg@mail.gmail.com>
Subject: Re: XLanuch.exe is a Trojan-It allows remote control of my pc without my knowledge or permission [Reference Link]
To: cygwin <cygwin@cygwin.com>
Content-Type: text/plain; charset="UTF-8"

On Wed, Jun 28, 2017 at 12:48 PM, Sagar Kapadia wrote:
> Hi Erik,
> Thanks for your reply. I could not find the file in the windows
> directory or its sub folders. However, I saw the xlaunch configuration
> screen on my pc. It came up on its own. I tired killing it but it
> would start again.

That indicates something else on your machine is launching it, and
deleting it only blocked whatever else is on your machine from
starting it again.  No program, no matter how complicated, can
magically start itself; something else must always start it.  Virus
and trojan programs typically do this by running several different
very small programs that watch each other, and when any one program
from the malaicious package is killed, the others restart it.

> I installed it over a year ago, and I dont remember which mirror I
> used. However, I did use the standard installer.

This being new behavior after being installed over a year also points
to something else trying to use xlaunch rather than xlaunch itself
being the problem.

> By the way, I did not quite understand about top posting .

http://linux.sgms-centre.com/misc/netiquette.php#toppost

> I am replying only to you . If you permit, I will
> reply to the list too
> Sincerely,
> Sagar

Everything I've said has already been posted to the list; you need to
be subscribed to the list for the replies to come to you as a normal
practice, and it is highly recommended when posting to possible
problem to be subscribed at least as long as the problem is being
addressed.

-- Erik

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple