X-Spam-Check-By: sourceware.org Message-ID: <469C1B5A.8010201@gmail.com> Date: Tue, 17 Jul 2007 09:28:58 +0800 From: Carlo Florendo User-Agent: Thunderbird 1.5.0.12 (Windows/20070509) MIME-Version: 1.0 To: cygwin AT cygwin DOT com Subject: Re: hacked package on server References: <469B9A27 DOT 3090406 AT cs DOT wisc DOT edu> <469BBF7F DOT 9060504 AT cs DOT wisc DOT edu> In-Reply-To: <469BBF7F.9060504@cs.wisc.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Louis Kruger wrote: >> >> > As the package installed, I saw some strange behavior, I'm worried it >> > might have been some kind of trojan. >> >> Are you able to actually describe "strange behaviour" > > It crashed the setup program, which seemed to indicate it was installing > strangely named files. It also corrupted the cygwin package directory. > I could not run the setup program again even using a different mirror > until I cleaned out the file /etc/setup/vim.lst.gz. Your evidence seems > to indicate that it is simple corruption rather than tampering. I am > pleased to see that. And this evidence indicates that your system is infected *before* you even run setup.exe. So beware. ;-) Thank you very much. Best Regards, Carlo -- Carlo Florendo Softare Engineer/Network Co-Administrator Astra Philippines Inc. UP-Ayala Technopark, Diliman 1101, Quezon City Philippines http://www.astra.ph -- The Astra Group of Companies 5-3-11 Sekido, Tama City Tokyo 206-0011, Japan http://www.astra.co.jp -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/