1

In the last few years I've noticed that a growing number of Windows application installers attempt to make outbound connections on port 80 immediately upon running the installer. My firewall alerts me even before the Unknown Pulisher Run/Cancel prompt appears. I always deny these connections, which never seems to inhibit the installation in any way. Here are some examples host destinations that I've seen: www.download.windowsupdate.com, go.microsoft.com, cds34.iad9.msecn.net, csc3, crl.thawte.com, crl.usertrust.com, crl.comodoca.com.

Of course each installer program is different, but this is a highly consistent behavior. Is there any way to know the nature or purpose of these connections?

3

My firewall alerts me even before the Unknown Pulisher Run/Cancel prompt appears.

They're checking certificates, to make sure the installer really is what it says it is. Allow them through, and you might not see the prompt at all.

0

Is there any way to know for sure? Probably not, at least not without either A) inspecting/decoding the traffic and inferring based on that, or B) contacting the publisher.

Really, though, it's probably nothing more than latest version checking. Nobody wants anybody to be installing stale software, and it can happen, especially when shareware sites mirror installers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.