This is the mail archive of the
mailing list for the Cygwin project.
is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
- From: LMH <lmh_users-groups at molconn dot com>
- To: cygwin at cygwin dot com
- Date: Tue, 26 Mar 2019 15:53:48 -0400
- Subject: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
I am trying to run down some odd behavior on my system. I have reset my firewall to
"ask" for most operations and am trying to rebuild my rules.
While running a bash script that I wrote, I get notifications from my firewall that
bash.exe, sh.exe and uname.exe are attempting inter-process communication with
svchost.exe. I also get a notification that a potential threat to network traffic
interception or injection has been detected for the same processes. Blocking this IPC
does not appear to affect anything in how my script runs, so I am wondering what the
purpose of the communication is. The bash script does not make any connections.
I have observed that software that is trying to bypass a firewall and find a back way
onto the internet will often attempt to use svchost.exe to make the connection
because svchost.exe is often given free access by default.
Is there some reason I should be expecting these processes to talk to svchost.exe?
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple