RE: c+,.exe

[Matt Gregory <matt at hgagroup dot com>]

Randall R Schulz:

> Hi,
> 
> Well, this is curious. There's a c++.exe in my bin, and I 
> take it that it's 
> present in that of all Cygwin installs that include the C++ 
> compiler, right?
> 
> Here's the output of sum on /bin/c++.exe in my Cygwin install 
> (the latest 
> release versions of everything currently present on mirrors.rcn.net):
> 
> % sum /bin/c++.exe
> 02568    71
> 
> % c++ --version
> 2.95.3-5
> 
> 
> What's interesting is that '+' and ',' are adjacent ASCII 
> codes (0x53 vs. 
> 0x54 -- '+' vs. ','). So there's a three-bit difference 
> between "c++.exe" 
> and "c+,.exe"
> 

Yes, I did notice that.


> How could that have happened without triggering an ECC detection or 
> correction? It couldn't happen over the net and it couldn't 
> happen on a 
> hard drive. I assume it could not happen in GZIP or BZIP2 compression.
> 
> Non-parity RAM would seem the only possibility.
> 
> Curious, no?

I'm going to have to assume that it must be a virus infected file.
I did a diff on them and they are the same except for the c+,.exe
file has a different beginning and end.  I tried debugging the
"infected" file and it made several subroutine calls that have no
apparent function (like a cmp instruction immediately followed by
a return, and upon returning immediately subtract something from
eax), and eventually it came to an instruction that has no
mnemonic (0xD6).

I did find another .exe that is a copy of a program and the last
letter for the filename is also 1 character away from the original
name, although going in the other direction, but the file sizes
are nearly identical, whereas the c+,.exe file is 50K larger than
c++.exe.  I guess I'll deal with it.

Thanks for your replies, guys.

Matt

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/