{"thread":{"id":"47776","subject":"Windows: mintty.exe classified as exploit by AV software","startedAt":"2018-02-07T09:19:01Z","lastAt":"2018-02-07T09:19:01Z","messageCount":1,"participants":["Ehrt, Michael"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"338595","messageId":"AM6PR0402MB34640AF9BB8DD9DB1BB2241CE6FC0@AM6PR0402MB3464.eurprd04.prod.outlook.com","threadId":"47776","inReplyTo":null,"subject":"Windows: mintty.exe classified as exploit by AV software","fromName":"Ehrt, Michael","fromEmail":"m.ehrt@erco.com","sentAt":"2018-02-07T09:18:46Z","receivedAt":"2018-02-07T09:19:01Z","isPatch":false,"sender":{"key":"m.ehrt@erco.com","avatar":null},"body":"Hi everyone,\n\na few days ago I installed version 2.16.1.2, downloaded from https://git-scm.com/download/win on my Windows 7 system. The OS is Windows 7 Enterprise 64bit, Build 7601/SP1, in case it matters. This is a first time install, not an upgrade.\n\nOur current virus protection software is Cylance, from https://www.cylance.com/en_us/home.html\n\nDuring install, several executions of \nC:\\Program Files\\Git\\usr\\bin\\bash.exe\nwere blocked, the violation being given as \"Stack Pivot\". Our admins then temporarily lifted some rules for my device so that I could properly install it.\n\nBut now, when I start ...\n\"C:\\Program Files\\Git\\git-bash.exe\" --cd-to-home\n... Cylance classifies it as an Exploit, and blocks execution with the following messages:\nCategory: Exploit\nEvent: Blocked\nDetails: Violation: StackProtect; Application: C:\\Program Files\\Git\\usr\\bin\\mintty.exe\n(Screenshot available if needed)\n\nIf I start ...\nC:\\Program Files\\Git\\usr\\bin\\mintty.exe\ndirectly, and choose the 64 bit version from the dialog, it is allowes to start without getting blocked.\n\nMy current problem is that the security guys don't want to see this software installed on my machine because of this.\nAnd as Cylance is not a pattern-based AV, it's not something that will go away by waiting for the next daily update ...\n\nAny ideas about this?\n\nThanks\n\nMichael\n\n"}]}