0

OS: Windows 10 64-bit updated, usually used for development and Steam-CSGO.

Straight to the point: Solitaire just tried to connect to the internet.

Details: After tightening my firewall rules after a RAT was installed by my friend (who then proceeded to unendingly open John Cena's theme song), I noticed Solitaire trying to connect to 40.122.214.188 which is owned by Microsoft and is part of the Xbox network. The problem is, I never even played any built-in games on my unit. I've never played Microsoft's Solitaire so outbound sync is out of the question. I don't use an Xbox. I also can't find any scheduled task for it. The system is completely clean when this happened.

Also, it seems to be in a suspended state, but still up.

enter image description here

The executable is located in

C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.7.1041.0_x64__8wekyb3d8bbwe which looks legit.

Should I allow it?

enter image description here

Improve this question
6
  • 1
    This seems completely normal to me. Solitaire is now a Windows Store app, and can connect to Microsoft's servers to deliver you personalized ads, collect statistics, etc. It's in fine print in the EULA for Windows.
    – Jonathan Gray
    Jan 14, 2016 at 12:32
  • If someone installed some malware (in this case a RAT) the only solution to be almost 100% sure is to reinstall the machine.
    – André Borie
    Jan 14, 2016 at 13:00
  • @JonathanGray I see.
    – Aloha
    Jan 14, 2016 at 13:58
  • @AndréBorie It's clean. He made the RAT, and I've reviewed the source code. It doesn't modify anything, just gives him command line and desktop access. Also, I was in the same room as him when the incident happened. He didn't modify anything, just forked bombed the command start https://youtu.be/xE-piBUcSug
    – Aloha
    Jan 14, 2016 at 14:01
  • 1
    Isn't it susupcious that the executable isn't signed? I thought all Microsoft executables would be signed by default, even the games. I don't have a Windows 10 installation to check that, though.
    – Philipp
    Jan 14, 2016 at 15:09

1 Answer 1

Reset to default
4

If you don't plan on ever playing Solitaire on your machine, why allow it through the firewall? You can always reverse your decision later if you decide to become a Solitaire fanatic, but until then it's safer to just deny Solitaire access.

I know it looks legit and it almost certainly is the application trying to connect with the Microsoft network to collect statistics, but who knows? In a year or so the Solitaire game could be found with a major security hole, and then you'll be glad you kept it denied under the firewall. The tiniest slightest risk isn't worth it if you never plan to play the game.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .