Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
Message-ID: <F01697EC42BCD411A4680080C8E8651E5019@NET>
From: Matt Gregory <matt AT hgagroup DOT com>
To: cygwin AT cygwin DOT com
Subject: RE: c+,.exe
Date: Fri, 29 Jun 2001 17:58:43 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1460.8)
Content-Type: text/plain

Randall R Schulz:

> Hi,
> 
> Well, this is curious. There's a c++.exe in my bin, and I 
> take it that it's 
> present in that of all Cygwin installs that include the C++ 
> compiler, right?
> 
> Here's the output of sum on /bin/c++.exe in my Cygwin install 
> (the latest 
> release versions of everything currently present on mirrors.rcn.net):
> 
> % sum /bin/c++.exe
> 02568    71
> 
> % c++ --version
> 2.95.3-5
> 
> 
> What's interesting is that '+' and ',' are adjacent ASCII 
> codes (0x53 vs. 
> 0x54 -- '+' vs. ','). So there's a three-bit difference 
> between "c++.exe" 
> and "c+,.exe"
> 

Yes, I did notice that.


> How could that have happened without triggering an ECC detection or 
> correction? It couldn't happen over the net and it couldn't 
> happen on a 
> hard drive. I assume it could not happen in GZIP or BZIP2 compression.
> 
> Non-parity RAM would seem the only possibility.
> 
> Curious, no?

I'm going to have to assume that it must be a virus infected file.
I did a diff on them and they are the same except for the c+,.exe
file has a different beginning and end.  I tried debugging the
"infected" file and it made several subroutine calls that have no
apparent function (like a cmp instruction immediately followed by
a return, and upon returning immediately subtract something from
eax), and eventually it came to an instruction that has no
mnemonic (0xD6).

I did find another .exe that is a copy of a program and the last
letter for the filename is also 1 character away from the original
name, although going in the other direction, but the file sizes
are nearly identical, whereas the c+,.exe file is 50K larger than
c++.exe.  I guess I'll deal with it.

Thanks for your replies, guys.

Matt

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/