11

My firewall has recently started warning me that the application queryappblock.exe is trying to reach the internet.

Google did not provide useful information except, for this MSDN page http://msdn.microsoft.com/en-us/library/dn440719(v=pandp.60).aspx about Transient Fault Handling. This machine is not running cloud services but, does have VS2010 and 2012 installed.

Are they related and either way, what is it?

15

Analysis

The QueryAppBlock.exe file comes with the KB2952664 update, which applies to Windows 7 SP1. There's no official documentation; below you can find the information I gathered.

Customer Experience Improvement Program (CEIP)

CEIP collects information about how our customers use Microsoft programs and about some of the problems they encounter. Microsoft uses this information to improve the products and features customers use most often and to help solve problems.

Source: Microsoft Customer Experience Improvement Program

If you opt in, Windows collects statistical information about your system. A summary of the aggregated data is periodically uploaded to Microsoft servers.

The information that is sent includes details about the computer hardware configuration (such as the number of processors and screen resolution), performance and reliability (such as how quickly a program responds when you click a button), and information about use of the system (such as how many folders a user typically creates on the desktop).

Source: Windows Customer Experience Improvement Program and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2

KB2952664

This update helps Microsoft make improvements to the current operating system in order to ease the upgrade experience to the latest version of Windows.

Source: Compatibility update for upgrading Windows 7

The description is pretty vague, but what it really does is update the application telemetry libraries bundled with Windows 7. In particular, the update is aimed at detecting and collecting compatibility issues that may arise when upgrading to newer operating systems (i.e. Windows 8.x.).

These files will be updated:

C:\Windows\System32\aeinv.dll
C:\Windows\System32\aepdu.dll
C:\Windows\System32\aepic.dll

And these will be added:

C:\Windows\System32\CompatTel\aeinv.dll
C:\Windows\System32\CompatTel\compatctrl.dll
C:\Windows\System32\CompatTel\compatplugin.dll
C:\Windows\System32\CompatTel\compatResources.dll
C:\Windows\System32\CompatTel\cosquery.dll
C:\Windows\System32\CompatTel\DevInv.dll
C:\Windows\System32\CompatTel\drvmain32.sdb
C:\Windows\System32\CompatTel\drvmain64.sdb
C:\Windows\System32\CompatTel\hwcompat32.txt
C:\Windows\System32\CompatTel\hwcompat64.txt
C:\Windows\System32\CompatTel\hwexclude32.txt
C:\Windows\System32\CompatTel\hwexclude64.txt
C:\Windows\System32\CompatTel\QueryAppBlock.exe
C:\Windows\System32\CompatTel\sdbapiu.dll
C:\Windows\System32\CompatTel\setupcompat.dll
C:\Windows\System32\CompatTel\sysmain32.sdb
C:\Windows\System32\CompatTel\sysmain32runtime.sdb
C:\Windows\System32\CompatTel\sysmain64.sdb
C:\Windows\System32\CompatTel\sysmain64runtime.sdb
C:\Windows\System32\CompatTel\wdscore.dll
C:\Windows\System32\CompatTel\wica.dll
C:\Windows\System32\CompatTel\wica.ini
C:\Windows\System32\CompatTel\wicainventory.exe
C:\Windows\System32\CompatTel\CompliancePlugins\DVDPlaybackCompat.dll
C:\Windows\System32\CompatTel\CompliancePlugins\GadgetCompliance.dll
C:\Windows\System32\CompatTel\CompliancePlugins\MediaCenterCompat.dll
C:\Windows\System32\CompatTel\CompliancePlugins\SBCompatPlugin.dll
C:\Windows\System32\CompatTel\CompliancePlugins\TouchCompat.dll

Additionally, a Microsoft Compatibility Appraiser scheduled task will be created.

QueryAppBlock.exe

It's a command-line utility with no user interface. It was first included with the Windows Vista Upgrade Advisor tool, and has since been bundled with newer versions designed for Windows 7 and later.

Its purpose is to scans your hardware, devices, and installed programs for known compatibility issues with a newer Windows version by comparing them against a specific database. A report is created afterwards.

The compatibility infrastructure uses a database to identify application compatibility issues and their solutions. This database is an indexed binary file with an .sdb extension. The compatibility infrastructure provides a programming interface to access the database.

Compatibility issues can be addressed on an application-by-application basis at run time. Each application specified in the database contains one or more components that need a solution. Components are executable files that are generally described using their file attributes (for example, checksum).

Source: Application Compatibility Database

When manually run with no parameters, the program will display a brief description along with the command usage:

Application, device and bios block detector.

USAGE:
        queryappblock.exe /APPS /APPINV ProgramInventoryFile /DEVINV DeviceInven
toryFile /out AppBlockOutputFile /os UpgradeToOSVersion /appSdb SysmainSDBFile [
64BitSysmainSDBFile] /LOG loggingDirectory binDirectory [/REDUCED /runtimeAppSdb
 RuntimeSysmainSdbFile [64BitRuntimeSysmainSdbFile]]

[...]

Further reading

  • bios block detector. This would make sense for my situation. Windows is no longer the primary OS on this machine and if the scheduled task calls queryappblock.exe to check the system's "integrity", it makes sense that it detects some anomaly (and then tries to report it). Thanks a lot. Unfortunately I don't have enough rep to cast a vote... – gxtaillon May 27 '14 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.