Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
From: "bob sandefur" <rsandefur AT cam-llc DOT com>
To: <cygwin AT cygwin DOT com>
Subject: Trojan  associated with rsync and wget
Date: Tue, 3 May 2005 10:56:52 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-Id: <16465809356429@colorado-mail.cam-llc.com>
X-AntiSpam: Checked for restricted content by Gordano's AntiSpam Software
Note-from-DJ: This may be spam

Hi-

Norton antivirus thinks cygwin wget and rsync are trying to Trojan my
machines (first reported in December)
EG
Details:
Rule "Default Block Phinneas Phucker Trojan horse" blocked communication.
Local address: All local network adapters(2801).
Process name is "C:\cygwin\bin\rsync.exe".

And the net says wget and rsync do have this problem  (try google rsync
Trojan)
EG
http://linuxreviews.org/gentoo/gentoo_trojan_howto/.

I downloaded and compiled wget and rsync from net and replaced cygwin
versions - so far Norton has said northing

Norton doesn't complain very often so this may not be a fix

Anyone know if Norton and I are  unduly paranoid or if this is a real
threat?

Thanx


Robert (Bob) L. Sandefur PE
Senior Geostatistician / Reserve Analyst 
CAM 200 Union Suite G-13 Lakewood, Co
80228
rsandefur AT cam-llc DOT com
303 472-3240 (cell) <-best choice
303 716-1617 ext 14




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/