X-Spam-Check-By: sourceware.org
From: "Dave Korn" <dave DOT korn AT artimi DOT com>
To: <cygwin AT cygwin DOT com>
References: <12256294 DOT post AT talk DOT nabble DOT com> <08db01c7e404$93ac6760$2e08a8c0 AT CAM DOT ARTIMI DOT COM> <08dc01c7e407$c2536de0$2e08a8c0 AT CAM DOT ARTIMI DOT COM> <46CB0B09 DOT 40200 AT cox DOT net>
Subject: RE: Cygcrypt-0.dll ad-aware trojan alert
Date: Tue, 21 Aug 2007 17:19:02 +0100
Message-ID: <08de01c7e40e$fc8ecac0$2e08a8c0@CAM.ARTIMI.COM>
MIME-Version: 1.0
Content-Type: text/plain; 	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <46CB0B09.40200@cox.net>
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 21 August 2007 16:56, Greg Chicares wrote:

> On 2007-08-21 15:27Z, Dave Korn wrote:
>> On 21 August 2007 16:05, Dave Korn wrote:
>> 
>>> On 21 August 2007 15:52, PTBluster wrote:
>>> 
>>>> I just ran Ad-aware and got a hit for the IROffer object which uses
>>>> cygcrypt-0.dll. I've searched Ad-ware forum and with Google but could not
>>>> find much. I think cygcrypt-0.dll is a legit library file so I am wondering
>>>> if this hit is significant?
>>>   Almost certainly a false alarm... hang on, I'll update my .def file and
>>> check for you.
>> 
>>   Reproduced.  Yep, it's a false alarm.  md5sum still the same as
>> freshly-extracted copy from the package tarball.
> 
> FWIW, I ran 'cygcrypt-0.dll' with md5sum fcaaad96b6b4e41dbaf9076109dcb964
>   through http://virusscan.jotti.org/
> and its twenty malware scanners all found nothing. Perhaps that helps if the OP
> wishes to report this false positive to Ad-aware.

  Thanks for the reminder, but really it's not as much use saying "Someone told
me that jotti cleared it" as going to jotti and running the test yourself and
cutting and pasting all the results into the false positive report message, so I
did.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/