4

I've got this annoying outbound TCP connection from explorer.exe to 111.221.29.122 using port 443 (Windows 8.1). Apparently this is some kind of push notification service as describes here:

https://security.stackexchange.com/questions/87505/why-is-windows-explorer-making-external-connections

I have disabled everything I could think of, including these notification things, automatic updates and what not. I even tried to brutally kill the outbound connection. Nothing helps. It's amazing how so many programmers work their keyboards to get us all into the cloud while some of us desperately want some basic privacy...

Rhetoric aside, how do I make explorer.exe stop opening sockets without my consent?

UPDATE: Attached below is what I see. Do you see this on your Windows 8.1?

Improve this question
2
  • Have a look at this site: windows8tricks.net/2011/12/… ... it has some registry tweaks you can do to turn off Push Notifications ..
    – txtechhelp
    Jun 15, 2015 at 20:22
  • @txtechhelp, these instructions appear to be outdated as I don't have these registry keys, besides I've disabled all push notifications from "Change PC Settings/Search and apps/Notifications", so it's probably not about notifications and something else lingering there.
    – Dima
    Jun 16, 2015 at 5:34

1 Answer 1

Reset to default
0

If you search for "notifications" in your start screen, you will find the notifications settings page. Here you can turn off the notifications altogether or for specific apps.

As the other answer says, this is an internal Windows function and the IP address belongs to Microsoft.

Whilst you could indeed block all outbound access to that address, I think you will find that it is actually an inbound connection. That too can be blocked but it is easier to turn off notifications.

UPDATE: To actually block the connection, open Windows firewall and add 2 new rules. Inbound and Outbound. Create customer rules, accept the defaults until you get to the Scope page and set the remote IP address to 111.221.29.122 and the action to Block. Accept the rest of the defaults and give it a meaningful name and description so you can find what you did in the future to undo it again.

Improve this answer
8
  • I've disabled all notifications through "Change PC Settings/Search and apps/Notifications", I have also tried to disable an individual per app settings as well, no reaction. The connection stays active. Yes it is apparently a MS server.. So what, it is my computer after all. I tried to prevent exlorer.exe using public network by means of firewall, but that blocked all browsers as well. No luck so far.
    – Dima
    Jun 16, 2015 at 5:29
  • Regarding the UPDATE - I wish it was just one IP address to block.. The explorer.exe keeps connecting to a range of addresses and I don't know how big is this range. Right now it's hooked onto 111.221.29.76. I think it grabs a new address as soon as it gets hold of the public internet access. I think it's bizarre..
    – Dima
    Jun 16, 2015 at 21:49
  • That isn't bizarre at all, it is common practice for a global service. You would have to block the whole subnet but that might well have other implications. I recommend that you forget about it and move on. Even if you spend loads of time trying to "fix" this, it is integral to Windows and might well change in the next release which is only a month and a half away.
    – Julian Knight
    Jun 16, 2015 at 23:08
  • It's bizarre because it's against any common sense concerning privacy, not because they use the entire subnet to "ring home". This is what spyware and malware do..
    – Dima
    Jun 17, 2015 at 6:08
  • 1
    "The computer talking to other computers without user's consent is a computer running bizarre software" If that's what you think you must configure the Windows Firewall to deny everything that is not explicitly allowed, this way it will behave as you think it should.
    – Ignacio Soler Garcia
    Apr 28, 2021 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.