X-Spam-Check-By: sourceware.org
From: "Dave Korn" <dave DOT korn AT artimi DOT com>
To: <cygwin AT cygwin DOT com>
References: <12256294 DOT post AT talk DOT nabble DOT com> <08db01c7e404$93ac6760$2e08a8c0 AT CAM DOT ARTIMI DOT COM> <08dc01c7e407$c2536de0$2e08a8c0 AT CAM DOT ARTIMI DOT COM> <46CB0B09 DOT 40200 AT cox DOT net> <08de01c7e40e$fc8ecac0$2e08a8c0 AT CAM DOT ARTIMI DOT COM> <12261020 DOT post AT talk DOT nabble DOT com>
Subject: RE: Cygcrypt-0.dll ad-aware trojan alert
Date: Tue, 21 Aug 2007 20:22:32 +0100
Message-ID: <000601c7e428$9f7cf5e0$2e08a8c0@CAM.ARTIMI.COM>
MIME-Version: 1.0
Content-Type: text/plain; 	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <12261020.post@talk.nabble.com>
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 21 August 2007 19:58, PTBluster wrote:

> Dave, Greg:
> Thanks for checking. Also IROffer/cygcrypt-0.dll trogan was not detected by
> my scans with Spybot or AVG.
> The strange thing is that IROffer seems to be a ligit trogan and has been
> part of Ad-aware's defs since at least mid 2006. Perhaps a recent update is
> causing the problem; it wasn't there 14 days ago.

  It's undoubtedly a result of an update.  The dll hasn't changed, the .def file
has, I leave the logic as an exercise for the reader!  It's quite possible they
changed their detect signature for IROffer in order to avoid some other false
positive or collision, and accidentally ran straight into another one.  So it
goes.  NBD!

> If either of you haven't filled out a bug report, I can. 

  Already done: see
http://www.lavasoftsupport.com/index.php?s=f26f6deb442793a1969295d17d0493de&showt
opic=12074



    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/