X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=2.0 required=5.0	tests=AWL,BAYES_50,FREEMAIL_FROM,KAM_THEBAT,KHOP_THREADED
X-Spam-Check-By: sourceware.org
Date: Mon, 23 Apr 2012 14:52:23 +0400
From: Andrey Repin <anrdaemon AT freemail DOT ru>
Reply-To: Andrey Repin <cygwin AT cygwin DOT com>
Message-ID: <2610076794.20120423145223@mtu-net.ru>
To: "Watts, Simon (UK)" <SWATTS AT ngms DOT eu DOT com>, cygwin AT cygwin DOT com
Subject: Re: VIRUS: XWin.exe 1.12.0-4 "Bloodhound.Sonar.9"
In-Reply-To: <D466D8ED2A535D448228E410781DF5E48087A89DBC@APOLLOCCR.ng.local>
References: <D466D8ED2A535D448228E410781DF5E48087A89DBC AT APOLLOCCR DOT ng DOT local>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

Greetings, Watts, Simon (UK)!

> Just performed a routine update to cygwin, which resulted in the updated XWin.exe being quarantined due to a virus threat.

> Details:

>         setup.exe version:      2.769
>         source:         http://cygwin.xl-mirror.nl
>         xorg-servers-common version:    1.12.0-4

> Symantec Endpoint Protection reported XWin.exe contained "Bloodhound.Sonar.9"

>         file size:      2828127
>         hash:   157814B5160244D44E469CA9829124DABA14426F3D60E6A22B52E953625CA0B2
>         category:       application heuristic
>         scan type:      SONAR
>         SONAR Risk level:       High
>         SONAR:  High

> Reverting back to 1.12.0-3 from same source does *not* show this issue.

> Could be a false positive?  But AV policy prevents me from running it.

From the report, it seems like it's AV heuristic backfired.
https://www.virustotal.com/file/157814b5160244d44e469ca9829124daba14426f3d60e6a22b52e953625ca0b2/analysis/


--
WBR,
Andrey Repin (anrdaemon AT freemail DOT ru) 23.04.2012, <14:39>

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple