Solved

Why does Explorer.exe seek sa.windows.com(80) on open?

Posted on 2003-11-10
6
1,646 Views
Last Modified: 2008-02-01
Why is explorer trying to connect to Mirosoft everytime I open it.

Not IE but Windows "%SystemRoot%\explorer.exe".

Here is my NIS log:
Details: This one time, the user has chosen to "block" communications
Outbound TCP connection
Remote address,service is (sa.windows.com(207.46.248.249),http(80))
Process name is "C:\WINDOWS\Explorer.EXE"

Thanks in advance.
0
Comment
Question by:Suburb-Man
6 Comments
 
LVL 24

Expert Comment

by:Kenneniah
ID: 9717201
It's a part of the search assistant. It goes online to verify connections and possibly pull updates to the search assistant. I'm not sure if anyone has figured out exactly what the purpose is, but here's what MS says about it:

http://sa.windows.com/privacy/
0
 
LVL 24

Accepted Solution

by:
Kenneniah earned 125 total points
ID: 9717212
Software updates

The Search Companion Web Service is designed to automatically upgrade as product bugs are discovered and fixed and new features become available.  As you use the Search Companion service, it will periodically use your Internet connection to check whether certain supporting files have been updated.  If an update is available, Search Companion will replace the outdated supporting files on your machine with newer versions of those files downloaded from Microsoft servers.  Search Companion supporting files are very small, and downloads will only take a few seconds even on slow Internet connections.  Supporting files do not contain executable code, and can not be used to infect your machine with a software virus.

Search Companion may check for updates even if you are using Search Companion only to find files on your local system.  For example, if you use Search Companion to find only Music files on your machine, Search Companion may check to see if there are any new types of Music files that should be included in your search.  No information about your local system or the content of your search is ever sent to Microsoft during this update check.

0
 
LVL 3

Expert Comment

by:jman1980
ID: 9717215
there are various trojans that use legitimate names in your machine. the only legitimate reason that i could think of this trying to connect is if you have autoupdate enabled. if you dont, it could be something like this... http://www.cexx.org/dlder.htm
0
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

 
LVL 34

Expert Comment

by:sramesh2k
ID: 9718712
The Search Assistant connects to sa.windows.com to keep the Search feature up to date, tips, etc on the WindowsXP machine.  You can stop it from connecting by reverting to the Classic Search

This is done to check for updates to its features, tips, wording and etc. Not allowing access can cause its own set of problems, usually a "A file that is required........." error message.

http://groups.google.com/groups?q=sa.windows.com&hl=en&lr=&ie=UTF-8&selm=OdMBczeKDHA.1960%40TK2MSFTNGP11.phx.gbl&rnum=1
0
 
LVL 1

Author Comment

by:Suburb-Man
ID: 9725635
Thanks all,

     I do have windows (critical) autoupdate enabled and Error/Crash reporting, but I didn't know I had search companion installed/enabled. I'll confirm.

To jman1980, always good to check all posibilities, but since it is going to MS's site the only kind of virus/trojan I can think of is a traffic jammer type; DOS attack or the like. Since it is only once per opening explorer.exe, it is ligitimate.

I am torn at deciding solution: clearly Kenneniah answered my question, but sramesh2k told be about changing the setting.  Both are important. What is it and what to do about it. I should open another question ask what to do about it and let sramesh2k reply and then give answer and points. Yes that is what I'll do.
See: "Modifing Search Assistant sa.windows.com explorer.exe"
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20794784.html

Thanks again.
0
 
LVL 24

Expert Comment

by:Kenneniah
ID: 9725932
You are welcome and thanks for the points! In the future if you feel 2 people have helped you can split points between them instead of posting another question
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question