This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: Cygwin finally croaked


At 04:05 PM 10/29/2004, you wrote:
>"Larry Hall" <xxx@xxxx.xx> wrote in message 


<http://cygwin.com/acronyms/#PCYMTNQREAIYR>

Someone should bug gmane about this. 



>Larry I think I figured it out and it has nothing to do with Cygwin.  


<snip>


>When I did that I got cscript is not an internal command.  That is not good.  It meant my ccript.exe was missing.  Well sort of.  After investigating this I noticed I had a new Service and new user accounts in my Server.  Sure enough something was uploaded into my system directory.  It is a variant of ServU which is commonly used by hackers.  They used it in conjunction with:
>

<snip>

>There are two more services that also run.  I looked at the ini used to set it all up and so knew where to look.  I believe it happened due to the Windows Media Service because now that is broke.  I removed it.
>
>I found these because I knew the time the issue above started and I was able to see the new files created in my System directory around that time.
>
>Anyway I noticed the issue with Cygwin at about the same time.  I have cleaned these things out and voila Cygwin is fine now.
>
>Thanks for looking into this with me.


Well, I'm quite sure I would not have been able to direct you to what 
you found beyond the references I made to look at "other things" on your
system.  Clearly, you took that to heart though and found something very 
specific and very wrong (which your attempt to run the modified cygwin.bat 
file clearly showed - sorry I didn't comment on that earlier).  In any case,
well done.  Glad you found the problem and got things back under control.
Your persistence paid off and for more than just Cygwin. :-)


--
Larry Hall                              http://www.rfk.com
RFK Partners, Inc.                      (508) 893-9779 - RFK Office
838 Washington Street                   (508) 893-9889 - FAX
Holliston, MA 01746                     


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]