Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the last few years I've noticed that a growing number of Windows application installers attempt to make outbound connections on port 80 immediately upon running the installer. My firewall alerts me even before the Unknown Pulisher Run/Cancel prompt appears. I always deny these connections, which never seems to inhibit the installation in any way. Here are some examples host destinations that I've seen: www.download.windowsupdate.com, go.microsoft.com, cds34.iad9.msecn.net, csc3, crl.thawte.com, crl.usertrust.com, crl.comodoca.com.

Of course each installer program is different, but this is a highly consistent behavior. Is there any way to know the nature or purpose of these connections?

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

My firewall alerts me even before the Unknown Pulisher Run/Cancel prompt appears.

They're checking certificates, to make sure the installer really is what it says it is. Allow them through, and you might not see the prompt at all.

share|improve this answer
add comment

Is there any way to know for sure? Probably not, at least not without either A) inspecting/decoding the traffic and inferring based on that, or B) contacting the publisher.

Really, though, it's probably nothing more than latest version checking. Nobody wants anybody to be installing stale software, and it can happen, especially when shareware sites mirror installers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.