X-Recipient: archive-cygwin AT delorie DOT com X-Spam-Check-By: sourceware.org Date: Sun, 12 Dec 2010 14:59:51 -0500 From: Christopher Faylor To: cygwin AT cygwin DOT com Subject: Re: Fwd: Suspicious EXE named "[.exe" in c:\cygwin\bin? Message-ID: <20101212195951.GH14369@ednor.casa.cgf.cx> Reply-To: cygwin AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com References: <20101212171536 DOT GB14369 AT ednor DOT casa DOT cgf DOT cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com On Sun, Dec 12, 2010 at 12:26:54PM -0500, Jeffrey Walton wrote: >On Sun, Dec 12, 2010 at 12:15 PM, Christopher Faylor wrote: >> On Sun, Dec 12, 2010 at 11:53:28AM -0500, Jeffrey Walton wrote: >>>2nd try. >> >> The input is sanitized. >Hmm.... > >> It is not a database and it is not PHP. >My bad CGI then... > >> >> The "Internal Server Error" just means that the search took too long and >> that is likely because someone has been attempting a DDOS on >> sourceware.org for a couple of weeks. > >Nope, no DDOS. Just a simple 1= 1. You weren't being accused of issuing a DDOS. sourceware.org has been subjected to several attacks in the last few weeks and it has caused things to randomly slow down. >Are you sure it does not mean the error was due to using too much >memory when joining tables (or something similar)? Otherwise, I would >expect a 4xx error due to a bad client request. You mean tables in the nonexistent database? Yes, I'm extremely sure. >> And, the "[.exe" program is really supposed to be there. >Thanks. It looked very suspicious. > >> Since this is a regex search, the search term would be \[\.exe >OK. Thanks. > >> If you have further questions please use the cygwin mailing list. >OK. The Internal Server Error 500 page stated to use >sourcemaster AT The error message is a one-size-fits-all for sourceware.org, which is why you were told to send further questions here. However, since you are reporting 1) a nonissue and 2) a known issue, after 14 messages from you on the subject, I think there really is no reason to discuss this further. cgf -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple