X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:from:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=ZRqAnWlthsvVte2m
	y4G3Q6LmQP662mMJDUHFWQaNhC4SmbhFuxKpc5m4k+mUqk8jlDtYiiXBHP+KYuaG
	XG+bC754HMy8TgYOD30SMK3+n7+JH41I9lZ8zWKfy3y0Ipa6bQ8LB1k0jVsgL3cF
	ZqBXa9GnXLtOFWm6wbFneDj3rX0=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:from:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; s=default; bh=i8fXoIudyCYJCkyqFVfu+6
	cguRE=; b=TI1ow1ytsfeX/1y3DNVYyuXWvzVov33PZC26ocOgCTap/kDYgk1jtj
	5jNRCzJvn5yo/YpdZfF/BI86ZxrDEaoMT9C6gPjsHigjvQhu5EcI7eIZW8DDVaL3
	CmcxlTjmqgqupXnlQZfoCIfygphaWg1TmuVREw5SrOAp+i6Fjhj34=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-3.7 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 spammy=advised, talk
X-HELO: smtp-out-so.shaw.ca
Reply-To: Brian DOT Inglis AT SystematicSw DOT ab DOT ca
Subject: Re: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
To: cygwin AT cygwin DOT com
References: <eb25d3ee-7468-3886-4167-024d2efb9586 AT molconn DOT com> <874l7piedv DOT fsf AT Rainer DOT invalid>
From: Brian Inglis <Brian DOT Inglis AT SystematicSw DOT ab DOT ca>
Openpgp: preference=signencrypt
Message-ID: <f33bc465-fb78-5df0-7642-7054511defe0@SystematicSw.ab.ca>
Date: Tue, 26 Mar 2019 14:45:54 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <874l7piedv.fsf@Rainer.invalid>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

On 2019-03-26 14:12, Achim Gratz wrote:
> LMH writes:
>> Is there some reason I should be expecting these processes to talk to
>> svchost.exe?
> If your machine is in a domain they will contact the DC to get user and
> group information via standard Windows facilities.

Could it also be Windows instrumentation trying to send info about what's going
on the system?
I know there's a lot of stuff network admins like to block from leaving Windows
systems so that they have some hope of seeing real problems amongst the useful
traffic.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple