From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 12552 invoked by alias); 26 Mar 2019 19:54:47 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 12043 invoked by uid 89); 26 Mar 2019 19:54:46 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham version=3.3.1 spammy=H*u:5.1, interception, observed, H*r:192.168.10 X-HELO: ecbiz204.inmotionhosting.com Received: from ecbiz204.inmotionhosting.com (HELO ecbiz204.inmotionhosting.com) (70.39.146.139) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 26 Mar 2019 19:54:45 +0000 Received: from [76.119.37.63] (port=28370 helo=[192.168.10.27]) by ecbiz204.inmotionhosting.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.91) (envelope-from ) id 1h8s9g-006f18-Cw for cygwin@cygwin.com; Tue, 26 Mar 2019 15:54:43 -0400 To: cygwin@cygwin.com From: LMH Subject: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe Message-ID: Date: Tue, 26 Mar 2019 19:54:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-OutGoing-Spam-Status: No, score=-1.0 X-IsSubscribed: yes X-SW-Source: 2019-03/txt/msg00591.txt.bz2 Hello, I am trying to run down some odd behavior on my system. I have reset my firewall to "ask" for most operations and am trying to rebuild my rules. While running a bash script that I wrote, I get notifications from my firewall that bash.exe, sh.exe and uname.exe are attempting inter-process communication with svchost.exe. I also get a notification that a potential threat to network traffic interception or injection has been detected for the same processes. Blocking this IPC does not appear to affect anything in how my script runs, so I am wondering what the purpose of the communication is. The bash script does not make any connections. I have observed that software that is trying to bypass a firewall and find a back way onto the internet will often attempt to use svchost.exe to make the connection because svchost.exe is often given free access by default. Is there some reason I should be expecting these processes to talk to svchost.exe? LMH -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple