Re: cygcrypt-0.dll false virus positive?

2005-01-11 Thread Walter Garcia-Fontes 
Today the problem is gone, the last patterns of Officescan don't
report anything strange in the cygcrypt-0.dll from the crypt package
(the version in the mirrors, without recompiling). 

-- 
Walter Garcia-Fontes
Barcelona


--
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple
Problem reports:   http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ:   http://cygwin.com/faq/

Re: cygcrypt-0.dll false virus positive?

2005-01-10 Thread Corinna Vinschen 
On Jan 10 11:14, Harig, Mark wrote:
> 
> > -Original Message-
> > From: Walter Garcia-Fontes
> > Sent: Monday, January 10, 2005 10:44 AM
> > To: Cygwin
> > Subject: cygcrypt-0.dll false virus positive?
> > 
> > 
> > Since this morning I get Trend Micro Office Scan antivirus to report a
> > virus in /usr/bin/cygcrypt-0.dll. It is strange since this started
> > without having reinstalled anything, maybe after an automatic update
> > of the patterns of the antivirus. 
> > 
> 
> I attempted to report this problem earlier today, also.
> For some unknown reason, it did not show up in the
> mailing list.  Here is a copy of the information I
> have about this possible virus:

Symantec Anti-Virus doesn't report a virus and there is none in
the tar archive on cygwin.com.   The last change to this file was
on 2003-10-19.  If you're unsure, just check the md5sum of your
downloaded crypt-1.1-1.tar.bz2 file.  It should be

  $ md5sum crypt-1.1-1.tar.bz2 
  7d7f1557a813840a537002ed593de194 *crypt-1.1-1.tar.bz2


Corinna

-- 
Corinna Vinschen  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader  mailto:cygwin@cygwin.com
Red Hat, Inc.

--
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple
Problem reports:   http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ:   http://cygwin.com/faq/

RE: cygcrypt-0.dll false virus positive?

2005-01-10 Thread Harig, Mark 

> -Original Message-
> From: Walter Garcia-Fontes
> Sent: Monday, January 10, 2005 10:44 AM
> To: Cygwin
> Subject: cygcrypt-0.dll false virus positive?
> 
> 
> Since this morning I get Trend Micro Office Scan antivirus to report a
> virus in /usr/bin/cygcrypt-0.dll. It is strange since this started
> without having reinstalled anything, maybe after an automatic update
> of the patterns of the antivirus. 
> 

I attempted to report this problem earlier today, also.
For some unknown reason, it did not show up in the
mailing list.  Here is a copy of the information I
have about this possible virus:


> -Original Message-
> Sent: Monday, January 10, 2005 10:25 AM
> To: cygwin list
> Subject: Possible virus in cygcrypt-0.dll
> 
> 
> My virus detection software (OfficeScan, version 5.58,
> engine 7.100, pattern 2.337.00) has detected the virus:
> 
> BKDR_HACDEF.M
> 
> in the file cygcrypt0.dll, which is included in the
> Cygwin package crypt-1.1-1.  This has been detected on
> three PCs, run (independently) by two people.  It appears
> that the problem is localized to the crypt-1.1-1.tar.bz2
> file at the rcn.net mirror.
> 
> Here are the steps that I took to localize the problem after
> it had been automatically detected by my virus scanning
> software:
> 
>1. Uninstall crypt-1.1-1 using setup.exe.
> 
>2. Delete crypt-1.1-1.tar.bz2 from the rcn.net 'release'
>   subdirectory that installation packages are written to.
> 
>3. Download/install crypt-1.1-1 from the planetmirror.com
>   mirror using setup.exe.
> 
>4. Scan both the 'bin' and 'release' subdirectories for viruses.
>   No viruses were detected.
> 
>5. Uninstall crypt-1.1-1 using setup.exe.
> 
>6. Delete crypt-1.1-1.tar.bz2 from the planetmirror.com
>   'release' subdirectory that installation packages are
>   written to.
> 
>7. Download/install crypt-1.1-1 from the rcn.net mirror using
>   setup.exe.
> 
>8. Scan both the 'bin' and 'release' subdirectories for viruses.
>   The BKDR_HACDEF.M virus is detected in bin/cygcrypt-0.dll
>   and in release/crypt/crypt-1.1-1.tar.bz2.
> 
> This detection appears to be the result of a new virus pattern file
> that detects the BKDR_HACDEF.M virus, which earlier versions of
> the file did not.
> 
> ---
> 

--
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple
Problem reports:   http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ:   http://cygwin.com/faq/