Share via

Windows Apps (blocked by Bitdefender Firewall) legit? I Need help in Identifying if these are Legit/Safe or Not

Anonymous
2021-09-11T11:16:24+00:00

Hi,

I need help identifying these Windows Apps I blocked from communicating in the internet through Bitdefender Firewall. Are these apps legitimate and critically needed for Windows to function? Specific explanation/answer about each application (what are they and what do they do) is much appreciated. I prefer Microsoft Agents to answer this. Thanks very much!

The application backgroundTaskHost.exe attempted to connect to the Internet:

File path: C:\Windows\System32\backgroundTaskHost.exe

Destination:

Protocol: TCP

Port: HTTPS

The application SDXHelper.exe attempted to connect to the Internet:

File path: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\SDXHelper.exe

Destination:

Protocol: TCP

Port: HTTPS

The application SystemSettings.exe attempted to connect to the Internet:

File path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Destination:

Protocol: TCP

Port: HTTPS

The application pingsender.exe attempted to connect to the Internet:

File path: C:\Program Files\Mozilla Firefox\pingsender.exe

Destination:

Protocol: TCP

Port: HTTPS

The application GfxDownloadWrapper.exe attempted to connect to the Internet:

File path: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_dc2a57d591329a30\GfxDownloadWrapper.exe

Destination:

Protocol: TCP

Port: HTTPS

The application OfficeClickToRun.exe attempted to connect to the Internet:

File path: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

Destination:

Protocol: TCP

Port: HTTPS

The application UpgradeTool.exe attempted to connect to the Internet:

File path: C:\ProgramData\OEM\UpgradeTool\ControlCenter_v4\UpgradeTool.exe

Destination:

Protocol: TCP

Port: HTTPS

The application LiveUpdateChecker.exe attempted to connect to the Internet:

File path: C:\Program Files (x86)\Acer\ControlCenter\LiveUpdateChecker.exe

Destination:

Protocol: TCP

Port: HTTPS

The application MSI7A16.tmp attempted to connect to the Internet:

File path: C:\Windows\Installer\MSI7A16.tmp

Destination:

Protocol: TCP

Port: HTTP

The application Microsoft.Photos.exe attempted to connect to the Internet:

File path: C:\Program Files\WindowsApps\microsoft.windows.photos_2021.21070.22007.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

Destination:

Protocol: TCP

Port: HTTPS

The application hermes.exe attempted to connect to the Internet:

File path: C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe

Destination:

Protocol: TCP

Port: HTTPS

The application rundll32.exe attempted to connect to the Internet:

File path: C:\Windows\System32\rundll32.exe

Destination:

Protocol: TCP

Port: HTTPS

The application wermgr.exe attempted to connect to the Internet:

File path: C:\Windows\System32\wermgr.exe

Destination:

Protocol: TCP

Port: HTTPS

The application taskhostw.exe attempted to connect to the Internet:

File path: C:\Windows\System32\taskhostw.exe

Destination:

Protocol: TCP

Port: HTTPS

The application OfficeC2RClient.exe attempted to connect to the Internet:

File path: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Destination:

Protocol: TCP

Port: HTTPS

The application CompatTelRunner.exe attempted to connect to the Internet:

File path: C:\Windows\System32\CompatTelRunner.exe

Destination:

Protocol: TCP

Port: HTTPS

The application ControlCenter.exe attempted to connect to the Internet:

File path: C:\Program Files\WindowsApps\acerincorporated.4703949ad09f_4.0.3019.0_x64__48frkmn4z8aw4\Win32\ControlCenter.exe

Destination:

Protocol: TCP

Port: HTTPS

The application maintenanceservice.exe attempted to connect to the Internet:

File path: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Destination:

Protocol: TCP

Port: HTTP

The application SimpleSolitaire.UWP.exe attempted to connect to the Internet:

File path: C:\Program Files\WindowsApps\26720randomsaladgamesllc.simplesolitaire_7.2.9.0_x64__kx24dqmazqk8j\SimpleSolitaire.UWP.exe

Destination:

Protocol: TCP

Port: HTTPS

The application RuntimeBroker.exe attempted to connect to the Internet:

File path: C:\Windows\System32\RuntimeBroker.exe

Destination:

Protocol: TCP

Port: HTTPS

The application WINWORD.EXE attempted to connect to the Internet:

File path: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Destination:

Protocol: TCP

Port: HTTPS

The application OLicenseHeartbeat.exe attempted to connect to the Internet:

File path: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

Destination:

Protocol: TCP

Port: HTTPS

The application Integrator.exe attempted to connect to the Internet:

File path: C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

Destination:

Protocol: TCP

Port: HTTPS

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. Anonymous
    2021-09-11T14:56:39+00:00

    Hey there Wharson!

    I am Miguel Ángel, an independent advisor and also a Microsoft user just like you. I'll try to help you with your doubt today.

    By what I can see, and as my mate said, those executables are legitimate. I'll try to give a detailed explanation for each:

    "backgroundTaskHost.exe" is just a component required for Cortana to run, which is Windows 10 virtual assistant. It is legitimate, and it is also necessary for many Windows functions. Since it is a SYSTEM32 protected folder, it's legitimate.

    SDKHelper is a component needed by Office to run updates. Something similar to Office Click to Run, OfficeC2RClient, Winword and the Integrator executable, which are all components of Office. Blocking them from accessing the internet will surely cause you issues when updating, when verifying your Office license or when using Office online services.

    CompactTelRunner is a Windows service that retrieves data in order to fix issues and improve your Windows experience. Disabling it, again, may involve problems in the future when you experience an issue.

    OLicenseHeartbeat is the Office service required to check your Office license, and to adapt your app to the features that you've paid for. Disabling it will involve issues with Office licensing.

    WERMGR is the service that sends error information whenever your device encounters any kind of problem (either solvable or critical). Disabling it can probably make debug information not generate, and therefore troubleshooting will become difficult.

    The MSI7A16.tmp located in C:\Windows\Installer\MSI7A16.tmp seems to be an installer from MSI, probably an update. If you're not installing or updating anything, you can delete that file in the location and it would be safer than keeping it there.

    The maintenanceservice.exe executable is part of Mozilla Firefox, and it just helps Mozilla Firefox find updates and install these. You should not block this neither, because it helps receiving Mozilla Firefox updates, and this is crucial for security concerns.

    RUNDLL32 is a CRUCIAL Windows 10 process and it's completely legitimate as it runs in WINDOWS32. It moves libraries so Windows can efficiently use them. Internet access should NOT be blocked, as it's one of the most crucial Windows processes.

    The other processes belong to WindowsApps folder, which is a completely protected and shielded folder, so there is nothing to worry about. These are apps coming from Microsoft Store, mainly.

    I hope it helped, and it also cleared some of your fear :)

    10+ people found this answer helpful.
    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-09-11T15:38:32+00:00

    Hey there WhArg!

    I'm truly glad that it helped! It could definitely be useful, but with the quantity of services that Windows and Microsoft handles... It'd be a bit huge!

    Remember to delete C:\Windows\Installer\MSI7A16.tmp if you're not installing or updating anything, just in case, and always keep your antivirus updated and working!

    Have a lovely week, stay safe under these rough times, and thank you so much for your rating! :)

    0 comments
  2. Anonymous
    2021-09-11T15:16:49+00:00

    Many thanks Miguel!

    I think your answer is the answer I've been waiting. It's very helpful. At least I can now be confident that those apps pose no threats except making windows functional. But I really hope that Microsoft come up of a reference list for consumers regarding windows apps and services so that identifying suspicious processes would be easy and not affect the ones that are legitimate.

    0 comments
  3. Anonymous
    2021-09-11T11:50:37+00:00

    Good Day WharsonArguelles,

    My name is Carlo, I am also using Windows 10 pc and community member like you.

    It appears that those apps are legitimate, it will not cause any harm in your device, rest assured that those running apps are safe and not a threat. You have nothing to worry about it.

    You might experiencing false positive detection with the Bit Defender, you can visit this link to know more about Bit Defender False Positive results.

    https://www.bitdefender.com/consumer/support/an...

    Have a wonderful day ahead and stay safe.

    Sincerely,

    Carlo T.

    Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

    0 comments