Articles

Windows Explorer internet access

March 21, 2005 at 11:16:09
Specs: 98SE, 1 GHZ/256

Does Windows Explorer need internet access to launch programs? ZA Pro is asking permission.

See More: Windows Explorer internet access

Report •


#1
March 21, 2005 at 13:51:34

Nope. Windows Explore just continuously runs once booted. "Internet" Explorer opens when you go on line (if that's the browser you are using).

Are you updating and running AV checker and malware finders/fixers such as "Ad-Aware" and/or "SpyBot Search & Destroy"?

I don't know the reason for this but it seems worth running the above for starters.

Derek.W


Report •

#2
March 21, 2005 at 13:53:57

Should have said, let ZA continue to block it for the time being. If this creates some problem shout back.

Derek.W


Report •

#3
March 21, 2005 at 15:36:08

I just wanted to say that I have been having the same thing happening since I had incountered a problem when my internet address had changed in my ZoneAlarm Pro Security Suite. I had made a post below here about that.

Mine is asking for Explorer.EXE and also ask for C:\WINDOWS/Explorer.EXE. Explorer.EXE gets a high and a medium warning and C:\WINDOWS/Explorer.EXE gets a high warning. I have my log event set to only high warnings now. I am just wandering why we are suddenely gettings these warnings?

I have manually blocked my Windows Explorer in the ZoneAlarm Programs. I'm not sure what is going on with ZoneAlarm or Maybe it is Microsoft.

Right after I got my ip address to work again ZoneAlarm had also been asked for a couple of components to be allowed to run. I, not knowing what they were, did allow them to run since the properties said that they were a Mictosoft item.

I also noticed ZoneAlarm has a new type of info boxes that appear when you click on more info for a new componet warnning. At least I had never seen it before.

I would guess that ZoneAlarm Pro or Microsoft has updated something? I just wished that we would be notified of these kind of things since some of us don't know a whole lot about some of these things, so we would have some kind of idea as to say ok or to deny things. I just hope that I did the right thing.

I'm not ignorant, I just need more learning!


Report •

Related Solutions

#4
March 21, 2005 at 15:43:44

Hmmm...I ended task on AVG, and don't get the message anymore. Yes, I do use Spybot S&D, CCleaner, Adaware SE and Pest Patrol. They are all UTD, and ran about once a week. AVG was the only thing running besides Explorer and Systray when I opened Firefox. I was denied internet access when I disallowed Windows Explorer. To troubleshoot, I also opened Opera, and MSIE. Again, I could not connect to the internet unless I allowed Windows Explorer.

I wonder what AVG may have to do with this? I just updated to ZA Pro today (bought in store), and this is when the messages started. ZA Free Edition did not alert me to this.

Thanks so much for you help, Derek. I'm gonna keep researching. :O)

Janet



Report •

#5
March 21, 2005 at 15:58:01

Oh, Tammy...I just posted this and didn't see your message. hehe...must've taken me 7 minutes to type that one.

Well, Since that post, I rebooted without AVG running, and the question went away. However, I just learned that this new ZA Pro lost it's default settings on reboot, and the Advanced Program Control reverted back to Medium instead of High. Ooops, the Windows Explorer message occurs if the setting is on High...even with AVG outta the picture.

Back to square one.

It must be something in ZA Pro. I still don't understand why Explorer would need access to the internet. I can't browse unless I allow Windows Explorer access.

Thanks for your help Tammy. Maybe we'll get this figured out...

:O)
Janet



Report •

#6
March 21, 2005 at 16:11:10

I'll bet it's one of the "components"...but I'd have to research each one individually. YUCK!
(I have 72)...

Report •

#7
March 21, 2005 at 16:17:05

Hi Each

Do a "find" for explorer.exe and see if you only find one of them. It should be in c:\windows

I'm assuming both of you are using W98SE.

Derek.W


Report •

#8
March 21, 2005 at 16:33:02

I found only one EXPLORER.EXE
Version 4.72.3110.1
176 KB

I'm using W98SE, and have all the critical patches loaded.

I'm presently checking each of the dll's (components), and what they are associated with. Hey, I'm bored tonight anyway. LOL!

I can't help but think about IronMan's post on rootkits. LOL. I think all the spyware and virii stuff is under control. Unfortunately there's not a scanner available for W98 that I've found. Just when you think you're safe.....


Report •

#9
March 21, 2005 at 16:47:32

Type sfc in the Run box and use the extract one file feature to replace the explorer.exe file from your W98SE CD.

This file should never change but there is a worm around that infects it. You will have to reboot afterwards.

By the way, it is fine to replace that file from sfc but if you are new to sfc take care if you decide to use at a later date. See my collation and WhitPhil's additions:

SFC CAN GET IT WRONG

If that is not any better download update and run this free trojan finder just to be on the safe side:

A2FREE - JUST DOWN THE PAGE

Derek.W


Report •

#10
March 21, 2005 at 17:04:28

I'm running Windows XP Pro HP Media Center Edition.

I have an explorer.exe in C:\Windows
and EXPLORER.EXE02121B1A.pf in C:\WINDOWS\prefetch
and this other listing explorer.exe in C:\WINDOWS\system32\dllcache

I'm not ignorant, I just need more learning!


Report •

#11
March 21, 2005 at 17:20:48

Tammy

I can't help much I'm a W98SE type. It does seem odd though that it also appears in folder dllcache (there's just the one in W98). Similarly I'm not sure if/how sfc works in XP. Let's hope an XP type will come along and help you.

In the meantime it is still worth downlading, updating and running that A2FREE I mentioned. If this finds anything it should fix it automatically.

Derek.W



Report •

#12
March 21, 2005 at 17:32:12

Tammy

Oh yes, I forgot. In Windows XP turn off system restore before running A2FREE. Put it back on again if/when all is well. Don't ask me how tho LOL.

Derek.W


Report •

#13
March 21, 2005 at 17:57:25

Tammy

Here's the "how to":

To turn off Windows XP System Restore
Click Start > Programs > Accessories > Windows Explorer
Right-click My Computer, and then click Properties.
Click the System Restore tab.
Check the "Turn off System Restore" or "Turn off System Restore on all drives" check box.

Derek.W


Report •

#14
March 21, 2005 at 17:58:57

Hey Derek,

I downloaded and updated A-Squared. No malware found. :O)

However, I have not yet replaced my EXPLORER.EXE in sfc. Perhaps it's been replaced with a baddy? I hope not. This may sound crazy, but I was reading some stuff on rootkits. They are pretty stealthy. The irony is that the TCP ports utilized by some of these rootkits are in my ZA alert log. i.e. TCP ports 445, 135, 137, and 2745 (coming from IP's within my ISP range). The Agobot worm is one that uses these ports to gain access (it's one of those new bot things). I'm getting slammed with these port scans. Now...are these infected machines looking for vulnerable machines, or do I have something invisible/stealthy, perhaps in Windows Explorer?

OK, I think too much...LOL


Report •

#15
March 21, 2005 at 18:13:45

OK, I replaced EXPLORER.EXE and rebooted. Same file size 176 kb, and same version. I didn't extract it from the CD though...I have the cab files in a folder on my HDD.

I still cannot browse (Firefox, MSIE or Opera) with the ZA Advanced Program Control set to HIGH unless I allow Windows Explorer internet access. Should I just set it to MEDIUM and forget about it?


Report •

#16
March 21, 2005 at 18:38:12

Fine from cabs obviously. No harm done but if was obviously fine anyway - at least we can now feel rather safer about it one way or another.

I don't know if you are set for web view/active desktop and all that stuff that I killed off years back (I'm a bit boring LOL and use "classic" - fast and simple). I did read that sometimes this can bring Windows Explorer into play if there are htm files around. You are not alone - take a look using Google "Groups" tab.

As a last ditch attempt clear your temporay internet files from IE (Tools/Internet Options/Delete files button - tick offline). Good thing to do from time to time anyway.

Otherwise I'm out of ideas. Medium is the default setting and I have a feeling you would be fine, although it does seem rather odd. No need to take my word for it though. See if anyone else comes along with some new thoughts.

Derek.W


Report •

#17
March 21, 2005 at 19:13:26

OK...dumped everything using CCleaner and Windows Washer. Persistent li'l sticky booger.

Thanks so much Derek for your help. I'll check out the Google Groups. I'm not ready to give up yet, but may eventually have to resolve to that. You've been awesome.

:O)

Janet



Report •

#18
March 22, 2005 at 03:03:09

Hello Janet,

I'll take an uneducated {don't use ZA Pro} guess. You might want to do some research, on "Andvanced Program Control" in ZA. Think it was a couple updates back, not certain.

Not much help there, sorry. But, in your searching use that Advanced Program Control. Should help you find an answer.
ZoneLabs User Forum

Good Luck,
CrazyOne

..it's a girl..:-)


Report •

#19
March 22, 2005 at 10:00:41

Janet,

This might not help with this problem but might be helpful with other settings.

Just in case you missed it when you went to the Zone Lab User Forum, or any body else interested, they gave this link to a guide of ZoneAlarm Program settings.

Here is the link to ZoneAlarm's Common Program Configuration & Information: http://www.zonealarmpro.bravehost.com/prexamp.htm

I think this site is great. Now, if we just knew where to find a list of the components, to allow or not allow settings?

I'm not ignorant, I just need more learning!


Report •

#20
March 22, 2005 at 11:06:00

Hey guys and gals,

I "think" I may understand what is happening. I got tired of looking at posts last night regarding why "Windows Explorer wants internet access." I don't think it really wants access...I think that Windows Explorer is needed to launch certain applications, like browsers. Like the tabs at the top of your browser you use...I think explorer.exe is needed for these functions. Zone Alarm is just alerting us to one program that is using another program needed to access the internet. I don't think it is needed for internet access, though, but you use it "while" you're on the internet. You can type a URL in the Windows Explorer address bar and get to a web page...DUH...I never knew you could do that...feeling stupid here...

Getting tired of reading the many, many posts on Explorer, and internet access, I read the functions of Explorer.exe (Windows Explorer). That kinda helped me understand why it pops it's head up when we launch our browsers. Here's a link that explains a little bit about Windows Explorer...not much, but brings perspective.

http://arachnid.pepperdine.edu/planitpepperdine/
Training/Win98/win98adv.html#Windows%20Explorer

See The Windows Explorer Standard Buttons Toolbar information on the link above. So, the way I see it...MSIE, Firefox, Opera, Thunderbird, Outlook, and OE...whatever...use Windows Explorer for these functions. Hope that makes sense.

Well, that's my story, and I'm sticking to it...besides, we drilled this one down to the earth's core...LOL. I see fire!

But if there are any other ideas out there...I'm game for suggestions. I know, too, that explorer.exe can be replaced by trojans/virii, and the like. Just replace it with a clean version, as Derek recommended, if in doubt.

Thanks Derek, Tammy and CrazyOne for your help!

Janet


Report •

#21
March 22, 2005 at 15:18:05

What throws me a bit is that no firewall I have used has "ever" asked my Win98SE to allow Windows Explorer access. I've used ZA, Sygate & Kerio freebies over the years.

Things might be different on XP and also if W98SE is not using "classic" settings (as I do). Classic settings don't use the web features in Windows Explorer. Like I said, lovely and boring LOL.

Derek.W


Report •

#22
March 22, 2005 at 15:42:28

Derek,

What are the W98SE classic settings? I'm ready to change them, and am feeling dumb here. LOL


Report •

#23
March 22, 2005 at 15:53:59

I'm not suggesting you do this particularly. You might prefer whatever features you have (many folk do). It could make it all seem a bit tame, rather like W95 or perhaps even W31.

If you still want to try it then it's in Start/Settings/Folder Options/General tab.

As if that's not bad enough I don't use Active Desktop either. Nothing ticked in:
Start/Settings/Active Desktop.

Might be interesting to see these make any difference to your problem (reboot first). If it's a big turn-off you can easily revert back.

Derek.W


Report •

#24
March 22, 2005 at 16:14:51

OK...set to Windows Classic Style, and no Active Desktop. Reboot. Slider pushed up to Advanced Program Control in ZA to test. Crappy Windows Explorer jumps right out. I ain't a bit surprised. DOH!

Somebody could win a Nobel prize ya know?


Report •

#25
March 22, 2005 at 17:04:34

Well it aint gonna be me because it knocked that thought of mine right on the head. Still, I suppose it's nice to know "what it isn't", that's one less thing it can be....

Sorry, out of ideas. Maybe some Nobel Prize winner will look by LOL (or are they too busy winning them?).

Derek.W


Report •

#26
March 22, 2005 at 19:49:56

You know I almost forgot, When I was reading the properties on a couple of either the components that were asking to run, I remember seeing it read something like XP-SP2.

Now this was strange to me because I haven't fully loaded sp2 and I remember canceling out the properties on each of these and reopening them. I don't remember if before or if after I gave these components permission to run in ZoneAlarm, but I do remember seeing them reading correctly, like XP-SP1.

Maybe Microsoft is setting things up for this SP2 to come down on us this April. You know they do things to us at times and has caused problems before.

I'm not ignorant, I just need more learning!


Report •

#27
March 22, 2005 at 21:24:14

Perhaps. You never know what to expect. Some day, I'd like to try Linux. Wonder if they have this many issues? LOL

Report •

#28
March 23, 2005 at 03:09:28

in 98SE windows explorer does try to access. If it don't, you don't. A friends comp I worked on and allowed access (had no other choice really) for explorer has had no problems. It's something to do with the amount of sharing between windows resources and IE resources.

D4Dog


Report •

#29
March 23, 2005 at 12:10:07

Dog & All

I use Kerio firewall so I make most of my rules myself.
I thought I'd look through my records and found that in fact I did block Windows Explorer access some time back. Sorry, I'd totally forgotten this. It came up twice when I was using RealOne on-line and then switched to Computing.net (one TCP Out, One UPD Out).

My note was last updated 23 Feb 04. It couldn't therefore have been later than that and I have had no ill effects. My suspicion is that it was probably RealOne doing it (a rather dubious program in that respect).

Derek.W


Report •

#30
March 28, 2005 at 13:09:05

UPDATE from my post at Zone Alarm Forum:

http://forum.zonelabs.org/zonelabs/board/message?board.id=security&message.id=11076#M11076

Thanks all for your input.
:O)

Sick computers don't ask for drugs or work excuses.


Report •

#31
March 28, 2005 at 13:33:29

Aha, we live and learn. Apologies then for my misleading first para in #1 (opinion and fact are obviously different things).

Thanks for useful info, and for taking the trouble to post back on here. Nice to see a bit of forum spirit for a change.

Derek.W


Report •

#32
March 28, 2005 at 14:47:50

Yeah...I'm still waiting on ones I tried to help a few days ago. LOL!

Derek, you did a great job helping. No apologies necessary. I just hope this helps someone down the road, as I see a lot on this subject, but no *real* answers. He got the Nobel Prize ya know. hehe

Sick computers don't ask for drugs or work excuses.


Report •

#33
April 6, 2005 at 22:29:41

Well I've used ZA for a long time now. To answer your question explorer.exe does not need access to the internet, yes it will work as a browser, but its technically not a browser since it does a lot more then just browse the web. Its an application like any other. Explorer will not request access to the internet unless your telling it to do so. Just like any third party application, when ya goto help and visit vendor webpage. You'll get the exact same message about blah wanting to access the internet. When ya click yes, what does it do, it launches your browser to the webpage. The program itself didn't actually go communicate with the vendor directly.

Personally i just use Firefox for a browser, and block both ie and explorer from accessing the net.


Report •


Ask Question