X-Recipient: archive-cygwin AT delorie DOT com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:to:from:subject:message-id:date:mime-version :content-type:content-transfer-encoding; q=dns; s=default; b=HSX Jh4iDYYV+PNyOw8Y72/VitoCSf4ji0TdjRruEnertVMiNV84YIaj14qdK3dQAP7Z k3jfBE5wOS4P2SnOKBh3JQWH5DKiEHgreKVLLCZCnkju1+dFfnFgbuSxVzzp4hFJ 44/uD6q2AvJwvbVLroeR1gUcMtehRftHrK7/un7o= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:to:from:subject:message-id:date:mime-version :content-type:content-transfer-encoding; s=default; bh=XFb8GPqHr rNMyjEFsRHsMelhaRQ=; b=V/psfe9epftUINgQCNWIecnai3BA1V8qRY/Ulm2NC 393h1CzBgexH4DKRin9PwBNDeRn7sZj4/e92DcfM8jlj3byWypgRXtSkFomsLjtJ pRpakHtul3Hgy1qMfWxoloi/l18Q/wqA74xkxP8ke6BH8CVPhFoJ+MwFXIdjPM2X Rc= Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham version=3.3.1 spammy=H*u:5.1, interception, observed, H*r:192.168.10 X-HELO: ecbiz204.inmotionhosting.com To: cygwin AT cygwin DOT com From: LMH Subject: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe Message-ID: Date: Tue, 26 Mar 2019 15:53:48 -0400 User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-OutGoing-Spam-Status: No, score=-1.0 X-IsSubscribed: yes Hello, I am trying to run down some odd behavior on my system. I have reset my firewall to "ask" for most operations and am trying to rebuild my rules. While running a bash script that I wrote, I get notifications from my firewall that bash.exe, sh.exe and uname.exe are attempting inter-process communication with svchost.exe. I also get a notification that a potential threat to network traffic interception or injection has been detected for the same processes. Blocking this IPC does not appear to affect anything in how my script runs, so I am wondering what the purpose of the communication is. The bash script does not make any connections. I have observed that software that is trying to bypass a firewall and find a back way onto the internet will often attempt to use svchost.exe to make the connection because svchost.exe is often given free access by default. Is there some reason I should be expecting these processes to talk to svchost.exe? LMH -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple