git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Windows: mintty.exe classified as exploit by AV software

From
EMEhrt, Michael <m.ehrt@erco.com>
Date
Feb 7, 2018, 09:18 UTC
Message-ID
<AM6PR0402MB34640AF9BB8DD9DB1BB2241CE6FC0@AM6PR0402MB3464.eurprd04.prod.outlook.com>
Hi everyone,
a few days ago I installed version 2.16.1.2, downloaded from https://git-scm.com/download/win on my Windows 7 system. The OS is Windows 7 Enterprise 64bit, Build 7601/SP1, in case it matters. This is a first time install, not an upgrade.
Our current virus protection software is Cylance, from https://www.cylance.com/en_us/home.html

During install, several executions of C:\Program Files\Git\usr\bin\bash.exe were blocked, the violation being given as "Stack Pivot". Our admins then temporarily lifted some rules for my device so that I could properly install it.

But now, when I start ...
"C:\Program Files\Git\git-bash.exe" --cd-to-home
... Cylance classifies it as an Exploit, and blocks execution with the following messages:
Category: Exploit
Event: Blocked
Details: Violation: StackProtect; Application: C:\Program Files\Git\usr\bin\mintty.exe
(Screenshot available if needed)

If I start ... C:\Program Files\Git\usr\bin\mintty.exe directly, and choose the 64 bit version from the dialog, it is allowes to start without getting blocked.

My current problem is that the security guys don't want to see this software installed on my machine because of this. And as Cylance is not a pattern-based AV, it's not something that will go away by waiting for the next daily update ...

Any ideas about this?
Thanks
Michael
Message 1 of 1 in “Windows: mintty.exe classified as exploit by AV software”
  1. Ehrt, MichaelFeb 7, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.