DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:cc:content-type; q=dns; s=default; b=GJg5
	uB5dJyAzlci13Y/oSZGh0ZG//0NjfqRBdbmEL0WDq+n4ipnNh0HJWP+a2fUfho1n
	h44nf7hI61HU9jp2h2mkwYukzuWBDgjETPtQHT8UZvjy3ULVb98HOdw0OgvmpGyf
	qBENLy4wNEYVSVLECYv2ltggX+u1lIIm4foQRgw=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
In-Reply-To: <22868.10096.929488.407450@gargle.gargle.HOWL>
References: <CAPXRkNEx44KFypaqj+hjrF+r8Es-xSmBTCcT2PED7XSrAchGNw@mail.gmail.com> <CACoZoo13PwvqZ6p6kuUAggTfBW0sF3absub0i7rFBXz50vLk5A@mail.gmail.com> <22868.10096.929488.407450@gargle.gargle.HOWL>
From: Dan Kegel <dank@kegel.com>
Date: Wed, 28 Jun 2017 15:13:20 -0700
Message-ID: <CAPF-yOZPH5m27Zy35x_6J96641yQrX7+HXnURLsjq3wNzxZWWg@mail.gmail.com>
Subject: Re: XLanuch.exe is a Trojan-It allows remote control of my pc without my knowledge or permission
To: cygwin@cygwin.com
Cc: Erik Soderquist <ErikSoderquist@gmail.com>
Content-Type: text/plain; charset="UTF-8"

On Wed, Jun 28, 2017 at 3:02 PM,  <bzs@theworld.com> wrote:
> I would also think about X11 permissions. Someone might be scanning
> for activity on port 6000 (&c) and if they find something and it's not
> locked down (see for example 'xhost(1)') it's trivial to just launch
> X11 apps on your system which can cause all sorts of mischief.

Also note that Xlaunch starts the X server, and can supply the
commandline option needed to listen for connections on TCP.
Maybe you put that in by accident while following some tutorial?

It'd be interesting to see who's trying to connect to your
machine via port 6000.  Maybe run wireshark and listen for a while?

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple