is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
LMH
lmh_users-groups@molconn.com
Tue Mar 26 19:54:00 GMT 2019
Hello,
I am trying to run down some odd behavior on my system. I have reset my firewall to
"ask" for most operations and am trying to rebuild my rules.
While running a bash script that I wrote, I get notifications from my firewall that
bash.exe, sh.exe and uname.exe are attempting inter-process communication with
svchost.exe. I also get a notification that a potential threat to network traffic
interception or injection has been detected for the same processes. Blocking this IPC
does not appear to affect anything in how my script runs, so I am wondering what the
purpose of the communication is. The bash script does not make any connections.
I have observed that software that is trying to bypass a firewall and find a back way
onto the internet will often attempt to use svchost.exe to make the connection
because svchost.exe is often given free access by default.
Is there some reason I should be expecting these processes to talk to svchost.exe?
LMH
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
More information about the Cygwin
mailing list