Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Message-ID: <3C6BCB35.4090104@cportcorp.com>
Date: Thu, 14 Feb 2002 09:35:33 -0500
From: Peter Buckley <peter DOT buckley AT cportcorp DOT com>
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.4) Gecko/20011019 Netscape6/6.2
X-Accept-Language: en-us
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: anybody else also infected
References: <01A7DAF31F93D511AEE300D0B706ED92019ECD65 AT axcs13 DOT cos DOT agilent DOT com> <4 DOT 3 DOT 1 DOT 2 DOT 20020214091816 DOT 01ee0518 AT pop DOT ma DOT ultranet DOT com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

I don't think that faq would have avoided or truncated this thread. It 
seems related, but it is in fact different.

If someone followed the instructions in the faq, they would have had a 
false positive reported on cygz.dll. Whenever the cygz.dll file was 
called (say, by invoking cygcheck), the real-time scanning of NAV popped 
up with "cygz.dll is infected with backdoor.egghead, and has been 
quarantined".

Maybe an addition to that faq needs to be made, that some antivirus 
programs (specifically symantec) have had false positives on cygwin dlls.

Just as an FYI, this same false positive for backdoor.egghead was seen 
on the cygwin1.dll from the 1.3.2-1 distribution.

-Peter

Larry Hall (RFK Partners, Inc) wrote:

> Hm, it seems like this entire thread could have been avoided or at least
> truncated by a simple visit to the FAQ:
> 
> Is setup.exe, or one of the packages, infected with a virus?
> http://cygwin.com/faq/faq_2.html#SEC11
> 
> Larry Hall                              lhall AT rfk DOT com
> RFK Partners, Inc.                      http://www.rfk.com
> 838 Washington Street                   (508) 893-9779 - RFK Office
> Holliston, MA 01746                     (508) 893-9889 - FAX
> 
> 
> At 08:39 AM 2/14/2002, hongxun lee wrote:
> 
>>Sorry for the panic...My bet is all you can do is to update the package zlib
>>...
>>NAV this morning had released its new vir-definition..Thanks
>>
>>----- Original Message -----
>>From: "KAMDAR,NILESH (A-Sonoma,ex1)" <nilesh_kamdar2 AT agilent DOT com>
>>To: <lee DOT 1801 AT osu DOT edu>
>>Sent: Wednesday, February 13, 2002 10:58 PM
>>Subject: anybody else also infected
>>
>>
>>
>>>Hello  Hongxun Lee,
>>>
>>>(I am not on the mailing list of cygwin so I am emailing directly to you)
>>>
>>>I have the same problem. My cygwin1.dll and cygz.dll file are in
>>>
>>quarantine.
>>
>>>NAV claims that they are infected with the BAckdoor.Egghead virus but I
>>>
>>dont
>>
>>>see any other signs besides the above 2 files. I Think NAV definitions are
>>>wrong!!!!
>>>
>>>I actually have SEVERAL customers who are going to complain about this
>>>tomorrow. So I am trying to find a quick resolution. I have also posted my
>>>question to Symantec.
>>>
>>>I am hoping that Symantec sends out newer update virus definitions which
>>>
>>DO
>>
>>>NOT cause this error.
>>>
>>>Let me know if you get any updates from them.
>>>
>>>Thanks.
>>>--Nilesh Kamdar
>>>
>>>
>>
>>--
>>Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>>Bug reporting:         http://cygwin.com/bugs.html
>>Documentation:         http://cygwin.com/docs.html
>>FAQ:                   http://cygwin.com/faq/
>>
> 
> 
> --
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
> Bug reporting:         http://cygwin.com/bugs.html
> Documentation:         http://cygwin.com/docs.html
> FAQ:                   http://cygwin.com/faq/
> 
> 


-- 
1 Timothy 4:12 (NIV)- Don't let anyone look down on you because you are 
young, but set an example for the believers
in speech, in life, in love, in faith, and in purity.


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/