From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 51542 invoked by alias); 26 Mar 2019 20:46:06 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 51365 invoked by uid 89); 26 Mar 2019 20:45:59 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-3.7 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 spammy=advised, talk X-HELO: smtp-out-so.shaw.ca Received: from smtp-out-so.shaw.ca (HELO smtp-out-so.shaw.ca) (64.59.136.138) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 26 Mar 2019 20:45:57 +0000 Received: from [192.168.1.114] ([24.64.172.44]) by shaw.ca with ESMTP id 8sxGhM6tqGusj8sxHh38gK; Tue, 26 Mar 2019 14:45:55 -0600 Reply-To: Brian.Inglis@SystematicSw.ab.ca Subject: Re: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe To: cygwin@cygwin.com References: <874l7piedv.fsf@Rainer.invalid> From: Brian Inglis Openpgp: preference=signencrypt Message-ID: Date: Tue, 26 Mar 2019 20:46:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <874l7piedv.fsf@Rainer.invalid> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2019-03/txt/msg00594.txt.bz2 On 2019-03-26 14:12, Achim Gratz wrote: > LMH writes: >> Is there some reason I should be expecting these processes to talk to >> svchost.exe? > If your machine is in a domain they will contact the DC to get user and > group information via standard Windows facilities. Could it also be Windows instrumentation trying to send info about what's going on the system? I know there's a lot of stuff network admins like to block from leaving Windows systems so that they have some hope of seeing real problems amongst the useful traffic. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple