Re: cygcrypt-0.dll infected

[Igor Pechtchanski <pechtcha at cs dot nyu dot edu>]

On Mon, 10 Jan 2005, Eddie Chan wrote:

> Hi,
>
> My weekly virus scan (office scan) has removed the cygcrypt-0.dll which
> was detected as infected by Backdoor.IRC.Aladin.R. I did some search on
> the internet and found that "Backdoor" virus comes with
> "cygcrypt-0.dll". I am guess that the virus scan has been updated to
> remove "Backdorr.IRC.Aladin.R" which has removed "cygcrypt-0.dll".
>
> I verify with other developers. Whenever we touch the cygcrypt-0.dll.
> The virus scan will think that it is infected and automatically remove
> it. Anyone know what to fix this problem???

Since the file hasn't been touched since October 2003, it's unlikely that
any new backdoor suddenly appeared.  Most likely your anti-virus software
detects this as a false positive, because some virus's (or trojan's)
pattern happened to coincide with what was already in the file.

It's amazing how many people use broken anti-virus software, judging by
the number of times this was reported.  The real solution is to get the
anti-virus patterns fixed.  One workaround that was suggested was to
recompile libcrypt, which removes the pattern (one can assume that the
pattern just happened to coincide with the DLL's date stamp -- go figure).

I'm half-tempted to suggest leaving the package as-is, just to force
people to complain to their anti-virus provider.  Unfortunately, all these
complaints are more likely to go to this list, thus rivaling the traffic
in the "obscenity of cygwin" thread (and we can't have that, can we?).

So, provided Corinna has the time and the inclination to build crypt-1.1-2
(identical to 1.1-1, but recompiled) and send it by private mail, can we
have a volunteer with a broken anti-virus to test this new version of
libcrypt?  If that shuts the anti-virus up, the path of least resistance
would be to release the new package...
	Igor
-- 
				http://cs.nyu.edu/~pechtcha/
      |\      _,,,---,,_		pechtcha@cs.nyu.edu
ZZZzz /,`.-'`'    -.  ;-;;,_		igor@watson.ibm.com
     |,4-  ) )-,_. ,\ (  `'-'		Igor Pechtchanski, Ph.D.
    '---''(_/--'  `-'\_) fL	a.k.a JaguaR-R-R-r-r-r-.-.-.  Meow!

"The Sun will pass between the Earth and the Moon tonight for a total
Lunar eclipse..." -- WCBS Radio Newsbrief, Oct 27 2004, 12:01 pm EDT

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/