Why does "explorer.exe" try to connect to the internet?

[LeveL]

The title sums it up.

This is not a spyware/adware/malware thing, it is Windows XP itself,

it even did this in Millennium. My question is, what is the reason for

explorer.exe trying to connect to the internet?

Why does it do this when you open a search window to search for

local files on your local drives? I know it has "Search the internet"

listed under search but come on, hasn't Microsoft ever heard of a

thing called "Google"??? They get hacked off enough when their

employees leave Microsoft and join Google (Ballmer throwing a

chair at an employee, lol) so then yes, Microsoft obviously know

theres no need for a "Search the internet" feature, my worry is,

when "explorer.exe" is connecting, it could be sending anything

across the internet to god knows who!

[cluberti]

You could always run a network trace and see what gets sent where - just a suggestion. Note that I am running 3 different versions of Windows, and NONE of my boxes do this - perhaps you have an explorer shell extension loaded or an Internet Explorer activex or BHO with a global hook that is doing this? I don't think it's actually explorer.exe doing anything malicious.

[nitroshift]

Or you can use Tcpview from Microsoft to see what processes connect to where and what ports they use.

Tcpview.exe

Edited April 12, 2007 by nitroshift

[erfahren]

I blocked explorer.exe in ZoneAlarm once because of a suggestion I read on a security site. A few days later I discovered I couldn't open a locally saved HTML file with a double-click if Opera was already open, a double-click would however launch Opera (with the file) if it wasn't. It took me a couple of hours screwing around untill I realized that it was the blocked explorer.exe that was the reason. Same problem with Firefox, never tried IE.

I tried setting Opera to work in offline mode and had the same results. I don't understand why that is.

[kelaniz]

Did you check that locally-saved HTML file to make sure it didn't still have any externally referenced items? (stylesheets, scripts, images, audio, video, server-side includes, etc..) That sounds like the most likely culprit. As for the inability to open it when a browser was already open.. That's...different. But I can see it happening if you'd blocked explorer.exe in ZoneAlarm. I never was very impressed with that program. It seemed to have a hard time differentiating between local and network activity. From what you said, maybe it still does?

Kel

[DonDamm]

Windows uses its own IE engine in Explorer and so any access, even if local, will invoke the 127.0.0.1 address (that's the loopback addy). ZA, and other firewalls will register this as an "internet access" when if fact, it's not. This is a Windows "anomoly". lol! :^) Why they haven't excepted that access to not trigger firewalls and other processes, I don't know. Anyway, for the most part, it isn't access the internet or any other computer but your own when it is doing this. If you were behind a router, you'd be able to test this. Just block all access at the router, but not in your software firewall and you'll see.