X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=1.6 required=5.0	tests=AWL,BAYES_00,FREEMAIL_FROM,KAM_THEBAT
X-Spam-Check-By: sourceware.org
Date: Wed, 29 Feb 2012 16:22:53 +0400
From: Andrey Repin <anrdaemon AT freemail DOT ru>
Reply-To: Andrey Repin <cygwin AT cygwin DOT com>
Message-ID: <835563459.20120229162253@mtu-net.ru>
To: Corinna Vinschen <cygwin AT cygwin DOT com>
Subject: Re: BLODA detection code in latest snapshot
In-Reply-To: <20120229085527.GO23440@calimero.vinschen.de>
References: <20120227122614 DOT GB31025 AT calimero DOT vinschen DOT de> <4F4C41B5 DOT 7040804 AT acm DOT org> <4F4C51D0 DOT 70307 AT acm DOT org> <20120228094024 DOT GD23052 AT calimero DOT vinschen DOT de> <16210489654 DOT 20120229024137 AT mtu-net DOT ru> <20120229085527 DOT GO23440 AT calimero DOT vinschen DOT de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

Greetings, Corinna Vinschen!

>> > Yup, confirmed.  This occurs on W7/32 as well.
>> > I add shlwapi to the list of filtered DLLs for which no such message is printed.
>> 
>> Could you please consider making such list configurable, if it's not much of
>> an issue?
>> This feature seems to be the reasonable way for rough detection of potentially
>> malicious presence, but I would like to avoid certain handlers to be reported,
>> such as antivirus' LSP or keyboard hotkey handler.

> Hmm.  Well, this option isn't meant to be used all the time.  It's not
> overly intrusive, but it costs time and Cygwin already isn't exactly
> fast.  For a pure diagnosing tool, does it makes sense to add lots
> of configuration options?

No, it doesn't. I've asked "just in cause" :)

> If you want to make the DLL list configurable, what's your idea?  Another
> env var like, say CYGWIN_DETECT_BLODA_DLL_IGNORE_LIST?

Registry key (REG_MULTI_SZ) would be better.
Speaking of which (a list of potentially intrusive DLL's) - do you filter by
DLL name or it's full path?
Because, %SystemRoot%\system32\shlwapi.dll is likely to be harmless.
But same name DLL inserted from any other place...


--
WBR,
Andrey Repin (anrdaemon AT freemail DOT ru) 29.02.2012, <16:09>

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple