17

McAfee is seeing Windows Explorer (explorer.exe) establishing connections to external IPs:

enter image description here

Also verified with cmd:

C:\Windows\system32>tasklist|find "explorer.exe"
explorer.exe                  4052 Console                    1    305,072 K

C:\Windows\system32>netstat -anob|find "4052"
  TCP    192.168.1.19:19049     111.221.124.106:443    ESTABLISHED     4052

C:\Windows\system32>

Why is Windows Explorer connecting to external IPs?

Is it OK to block Windows Explorer from all ports (e.g. with a firewall like McAfee / Kaspersky) or would that lead to system instability?

• Tested on Win 8.1 basic.

|improve this question
  • The Windows 8.1 Explorer.EXE shell cannot be blocked by using the builtin Advanced Firewall, but can be subverted by the Host file. Explorer.EXE will keep trying to connect to local host as viewed in TCPView app. I do notice that the connection attempts don't start with system startup, but may start hours or minutes later and then continue until shutdown. – Speedy Clip Dec 7 '17 at 22:32
23

This is normal and expected behavior for windows system. The IP you mentioned resolves to sinwns2012412.wns.windows.com.

The Windows Push Notification Services (WNS) enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.

How it works: The following diagram shows the complete data flow involved in sending a push notification. It involves these steps:

enter image description here

  1. Your app sends a request for a push notification channel to the Notification Client Platform.

  2. The Notification Client Platform asks WNS to create a notification channel. This channel is returned to the calling device in the form of a Uniform Resource Identifier (URI).

  3. The notification channel URI is returned by Windows to your app.

  4. Your app sends the URI to your own cloud service. This callback mechanism is an interface between your own app and your own service. It is your responsibility to implement this callback with safe and secure web standards.

  5. When your cloud service has an update to send, it notifies WNS using the channel URI. This is done by issuing an HTTP POST request, including the notification payload, over Secure Sockets Layer (SSL). This step requires authentication.

  6. WNS receives the request and routes the notification to the appropriate device.

Reference: https://msdn.microsoft.com/en-us/library/windows/apps/hh913756.aspx

|improve this answer
  • 1
    Since I've got no need for this (no windows store App), Is it ok to simply block it with a Firewall? Or will the system be unstable and crashy if we do so? – Pacerier May 5 '15 at 1:27
  • 12
    @Pacerier lots of people run Windows on airgapped computers. Not being connected to the internet doesn't cause them to belch magic smoke. – Dan Neely May 5 '15 at 3:24
  • You can disable, live notifications and notifications for applications. This won't affect your windows OS. – ciphercodes May 5 '15 at 11:16
  • 6
    Why the heck would they make this part of Windows Explorer, instead of some separate service...? – immibis Aug 5 '15 at 22:32
  • 1
    @immibis: I'm sure it made it easier for them to prevent explorer's own notifications from overlapping these. Of course, an API allowing notifications from any local application to be displayed without interfering with the shell notifications would have been best. – Ben Voigt Aug 5 '16 at 22:21
1

I had the same situation today. I have stopped and disabled the service

NetworkConnectionBroker

and the connection does not came up anymore.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.