locked
Why does SearchFilterHost.exe frequently try to access Internet?

    Question

  • Does anyone know why does SearchFilterHost.exe frequently try to access Internet?

     

    /Michel

     

    Tuesday, July 08, 2008 3:05 AM

Answers

  • That's also normal activity for that service.
    This service looks after the Internet look up for Help topics , and Desktop search on the Vista platform. Its also tied into the search indexer in Vista.
    It's a trustworthy service and can be allowed access, or you can turn off the option to Search the Internet for Help Topics by opening a Windows Help window, click Options, settings, then uncheck the "Include Windows Online Help & Support when you Search For Help" box. and the "Join the Help Experience Improvement Program" because if you signed up to help make Windows better, it needs to send this info to MS and that's another part of this service.

    Hope this helps.
    Sunday, August 17, 2008 9:21 AM

All replies

  •  MickTheSpick wrote:
    Does anyone know why does SearchFilterHost.exe frequently try to access Internet?

     

    /Michel

     



    I am wondering this myself. I only installed this Microsoft Desktop Search program last night as part of windows/microsoft update & ever since then SearchFilterHost.exe keeps asking to access the internet. I don't intend to give it access through my firewall if I don't have to. Is it just spyware from Microsoft? I really can't see why a "Desktop Search" program would need internet access because what does the internet have to do with my desktop?????
    Saturday, July 26, 2008 1:01 AM
  • I asked a Tech friend because I just started getting the same thing when the new search update, He said, Not 100% sure but it could be so that Microsoft can track the progress of how good you computer's search for files & folders utility is working, (something Microsoft does frequently with most of their programs on any computer)  This is done with or without user agreement and is included in the fine print of some of the user agreements that you have to agree with when you download or install one of their products., if you do not want it accessing the internet you can block it with the firewall ( if you have one that will allow you to block outgoing programs.
    Thursday, July 31, 2008 5:16 PM
  • Thanks for that DON976,

     

    I thought that may be the case but you can never be too careful these days with all the Trojans, viruses, etc..and I haven't read anything about this specific issue.

     

    Cheers.

    Friday, August 01, 2008 12:01 AM
  • Hi

    Are you sure it's accessing the Internet, or is it trying your loopback address at 127.0.0.1?

    It's normal to access the loopback.
    Tuesday, August 12, 2008 6:19 AM
  • On my computer, the process has made several requests to connect to the address 131.107.115.28 on port 80. A quick WHOIS search says that the IP is registered to Microsoft. Why does the search indexer need to contact Microsoft computers?
    Saturday, August 16, 2008 10:46 PM
  • Same here, it seems to be trying to access Internet.

    I've now filtered it out using my firewall so I'm not getting any messages but I doubt that it's stopped.

     

    Sunday, August 17, 2008 4:03 AM
  • That's also normal activity for that service.
    This service looks after the Internet look up for Help topics , and Desktop search on the Vista platform. Its also tied into the search indexer in Vista.
    It's a trustworthy service and can be allowed access, or you can turn off the option to Search the Internet for Help Topics by opening a Windows Help window, click Options, settings, then uncheck the "Include Windows Online Help & Support when you Search For Help" box. and the "Join the Help Experience Improvement Program" because if you signed up to help make Windows better, it needs to send this info to MS and that's another part of this service.

    Hope this helps.
    Sunday, August 17, 2008 9:21 AM
  •  

    That sounds reasonable, thanks a lot Chappy.

     

    Sunday, August 17, 2008 11:39 AM
  • Hi Mick

    My Pleasure!

    Glad I could ease some concerns regarding this service. It really is a trustworthy one but most people just don't know exactly what it's trying to do and that's always a bit scary. The "Help Make Windows Better" program allows for anonymous data to be sent to MS concerning the setup and general operation of the Vista platform across millions of machines & setups, so it really is a great way for MS to get a good look at what is working and what isn't in Vista.
    Also, I find the new Help & Support in Vista to be a bit convoluted at times and the Internet help access can really help with that.

    There have been some people report that this service has been maxxing out their CPU's. I think it was fixed in SP1, I'm not certain there, but some folks had to disable this one completely for awhile. I hope they remember to try turning it back on after SP1 and test it out but they probably won't.

    Anyway, I hope I was of some service. Take care.

    Dave
    Monday, August 18, 2008 12:38 AM
  •  Chappy wrote:
    That's also normal activity for that service.
    This service looks after the Internet look up for Help topics , and Desktop search on the Vista platform. Its also tied into the search indexer in Vista.
    It's a trustworthy service and can be allowed access, or you can turn off the option to Search the Internet for Help Topics by opening a Windows Help window, click Options, settings, then uncheck the "Include Windows Online Help & Support when you Search For Help" box. and the "Join the Help Experience Improvement Program" because if you signed up to help make Windows better, it needs to send this info to MS and that's another part of this service.

    Hope this helps.


    Strange, even after checking that these options are disabled, the service keeps trying to contact microsoft...
    Friday, October 17, 2008 2:28 PM
  • ^^^ Yep,  despite disabling the "phone home" options above and other MS phone hope options with xp-AntiSpy,  etc,  SearchFilter continues to try to talk to MicroSoft servers.  I disable this behavior at firewall;  I'm certainly not willing to accept that its data is merely "service quality improvement" related unless that's been proved.

    Ken Thomas
    http://www.hortongroup.com/
    The Drupal Communications experts

    Ken
    Sunday, December 14, 2008 2:25 AM
  • KenThomas1 said:

    ^^^ Yep,  despite disabling the "phone home" options above and other MS phone hope options with xp-AntiSpy,  etc,  SearchFilter continues to try to talk to MicroSoft servers.  I disable this behavior at firewall;  I'm certainly not willing to accept that its data is merely "service quality improvement" related unless that's been proved.

    Ken Thomas
    http://www.hortongroup.com/
    The Drupal Communications experts


    Ken


    You are right, Ken.

    I think it's time the community initiates another case before court against Microsoft.  This time for violating the integrity and privacy of personal information stored on a computer.

    A user should have always control to what he sends out to the internet.  So every attempt to call home from any program is a violation of privacy, if this is not explicit allowed by the user.

    This 'add-on' does not only consult a Certificate Revocation List server crl.microsoft.com, to reject a license, it has the possibility to send to microsoft an index of all stored files.

    I am happy You wrote this, because this finally proves Microsoft never learns and never adapts to the need of security and privacy.

    If You install software on Your PC, look how many callbacks are made to the software company.

    Is Your computer Yours ?  Not anymore, when You run software of Microsoft.

    It's a shame. But we known all in the heart, don't we.  Microsoft is just like that.

    So YES, this program violates privacy and does call back home at Microsoft.
    It's modern spionage.
    Monday, December 22, 2008 8:47 PM
  • Hey there every1...!
    Here's a HeadsUp..

    I have the same issue about searchfilterhost.exe trying 2 have access 2 the internet and wondered like the most of U guys in here: "Why in heaven's name does a windows search engine need 2 access the internet"?!

    And thanks Chappy, UR Xplanation sounds quite reasonable... :)
    I haven't disabled it via the Windows Helper, but merely banned it from accessing the net via my firewall, ZoneAlarm..

    But the thing I wud like 2 share with you guys R, that i read from the internet somewhere else that searchfilterhost.exe also can bug and make UR PC go really really slow, especially when U're using iTunes. This has something 2 do with some indexing problems that U can disable.

    I also read that many malware programs can disguise themselves as searchfilterhost.exe, so the advice that I read is that the searchfilterhost.exe is located on the C:\Windows\System32 directory. Then check if the searchfilterhost.exe file is the same size as the standard windows version given by a certain size. If the file is any bigger, a malware cud have attached itself 2 it..

    So that cud also be the worst case scenario Xplanation of Y the searchfilterhost.exe file is trying 2 access the internet. As said, this is what I heard, so it's not certain, but definately worth taking precautions for...
    So unless one is very keen 2 contribute Microsoft's already troublesome software, I recommend that U guys just

    1) Deny the files access to the internet via the firewall and
    2) Also uncheck the Online Help-thingy and Improvement thingy that chappy mentioned.. :)

    As told, I'm not entirely sure, just takin my precautions and telling U guys what I've read.. :) I'll give U the link about the possible malware threat.
    http://www.file.net/process/searchfilterhost.exe.html
    http://www.file.net/process/searchprotocolhost.exe.html

    Good Luck Guys and sorry for the long post.. :)
    Loco
    Wednesday, March 25, 2009 7:37 PM
  • The SearchFilterHost process is used to host 3rd party filters which knows how to read the document file (for example .pdf) and parse out the text content from it. This process runs under restricted right, which network access is removed. It is perfectly acceptable to not allow this process firewall access.

    http://msdn.microsoft.com/en-us/library/cc678933(VS.85).aspx

    I suspect that ZoneAlarm is detecting the network API call and reporting network access, even though the underling call will fail due to the security restriction. I have installed the latest version and I have not seen it report this error. I suspect that it has something to do with indexing a file with DRM restriction and it's trying to validate it's license. Using procmon.exe, you can track down the file that is causing this when the ZoneAlarm message appears, as the file will be currently opened in the SearchProtocolHost.exe process.

    Windows Search 4.0 does not ship with the ability to report back users configuration and does not participate in the "Join the Help Experience Improvement Program".


    Microsoft
    Tuesday, April 07, 2009 9:06 PM
  • My firewall lets me step through each sequential address that any application tries to connect to.  SearchFilterHost.exe first communicates with my ISP's router somewhere (I'm guessing to find out what the next hop is or to test if it can really get out to the internet) and then tries to go to wwwbaytest1.microsoft.com.  As I understand it, there are several of these servers...wwwbaytest2.microsoft.com, wwwbaytest3.microsoft.com et al.

    I'd put money down that these are Microsoft's activation servers and that the SearchFilterHost.exe program is checking in to see if you are legit or not.  Which, by the way, I have a MAJOR problem with!!  Not only do I have to activate Windows, I have to deal with Windows Genuine Advantage (WGA) and now yet ANOTHER program that constantly monitors me and reports back to the mothership.  I hope someone sues Microsoft over this.  This is a major privacy violation!

    I'm going to contact my Senators and Congressman and get them to make it illegal for ANY software to connect to the internet without my express permission each and every time.  I shouldn't need a firewall to control legitmate software--only shady software.

    Saturday, June 06, 2009 3:29 AM
  • That's also normal activity for that service.
    This service looks after the Internet look up for Help topics , and Desktop search on the Vista platform. Its also tied into the search indexer in Vista.
    It's a trustworthy service and can be allowed access, or you can turn off the option to Search the Internet for Help Topics by opening a Windows Help window, click Options, settings, then uncheck the "Include Windows Online Help & Support when you Search For Help" box. and the "Join the Help Experience Improvement Program" because if you signed up to help make Windows better, it needs to send this info to MS and that's another part of this service.

    Hope this helps.

    It does too under windows 2003, and where is "include Windows Online Help & Support... ?" What I c under Help and Support Center, is Change Help and Support Center Options, Set search options, and Install and share windows Help. None is "Include Windows Online Help"?
    binyo indonesia
    Tuesday, June 16, 2009 9:58 PM
  • This issue has nothing to do with the above statement. For WindowsXP, this issue was introduced with SP3. The media meta data handler is verifying that it's module is correctly signed and is just verifying it's certificate authenticity against a higher authority. The filter host does not have access right granted to it to actually allow Internet/Network access, so this access dialog is actually incorrect in reporting this information. You can configure your firewall to not to allow access with no detrimental functionality.
    Microsoft
    Tuesday, June 16, 2009 11:21 PM
  • What an arrogant answer.

    In the first place, You should not make call-home request at all, so we do not need to block it at firewall level.
    More, before some firewall are run, some still perform outgoing communication.  I am pretty sure the Microsoft internal firewall does !
    A pure path, a hole to Microsoft ! As 'trusted' entity.

    That's a violation of the privacy.  An user can not verify what stream of data is send to Your servers.
    This is gathering of data, statictics, usage as it opens the possibility to hijack this system for intrusion.

    For decades Microsoft embedded all kinds of callback.  A lot of hackers did exploit those things.

    a) Automatic updates
    b) Timesync with, indeed Microsoft servers
    c) Indexing and Usage information
    d) Reporting of errors -> We need a full report of Your system, from the registry !
    e) Using windows-installer, well, perform a callback to the software company

    When You install 10 programs, 10 perform callbacks using the windowsinstaller component.

    Now we have the SearchFilterHost.exe which indexes music, photo, movies or send information to Microsoft.
    To verify if this information is copyrighted material, licensed material, or what ?  Sure this will be the next step.

    Come-on. Windows seems to be a phone central ! All those tricks to monitor usage of the user, the consumer
    All for commercial reason, nothing else !  Or to protect copyright etc.

    Worse, some programs do not install without an internet connection !

    We consider this all NORMAL.  It isn't at all.

    Addionally, should we mention what is send by Microsoft Messenger ! The perform sign on, hello, we are online !

    It should be FORBIDDEN BY LAW to embed in software callbacks, even automatic updates, even forced activation by Internet.
    Because it disturbs the privacy. No program should perform any communication at all without the explicit permission of the user.

    Funny, when You want to disable such things, as Indexing, Messenger, Updates, it is always in the most difficult corners of the OS !
    • Edited by Woudy Ram Tuesday, June 30, 2009 1:37 PM
    Tuesday, June 30, 2009 1:27 PM
  • What is the effect to disable the search engine? I tried to make it manual, and somehow the latest search that I downloaded couple weeks back, on again? Or should i uninstall that one ?

    BTW, talking about "sue," i think it might be undergo in europe.
    binyo indonesia
    Tuesday, June 30, 2009 2:00 PM
  • Well, my SearchFilterHost tried to contact some Akamai services with that outbound traffic...

    In their site i found out this, on their Website:

    "If you use the Internet for anything - to download music or software, check the headlines, book a flight - you've probably used Akamai's services without even knowing it . We play a critical role in getting content from providers to consumers.

    Akamai has created a digital operating environment for the Web. Our global platform of thousands of specially-equipped servers helps the Internet withstand the crush of daily requests for rich, dynamic, and interactive content, transactions, and applications. When delivering on these requests, Akamai detects and avoids Internet problem spots and vulnerabilities, to ensure Websites perform optimally, media and software download flawlessly, and applications perform reliably.

    Hundreds of enterprises worldwide use our global platform to sell, inform, entertain, market, advertise, deliver software, and conduct their business online. Through our EdgeControl they also gain insight into worldwide Internet conditions and access to tools to manage their online business. With Akamai's managed services there's no infrastructure to build or deploy. We can have you integrated on our platform in just a few days.

    Today Akamai handles tens of billions of daily Web interactions for companies like Audi, NBC, and Fujitsu, and organizations like the U.S. Department of Defense and NASDAQ -- powering brand new business models that serve the changing online economy.
    "



    I wonder why it tried to contact them... :/
    Any ideas?
    Tuesday, September 15, 2009 7:16 AM
  • I have (successfully) disabled the service, in Control Panel =>Administration => Services, and I set the RPC (Remote Procedure Call) to deactivated, at the same time.
    My guess is, that SearchFilterHost cannot restart the service, as it is dependant on the RPC-service, which it cannot auto-start, when it is disabled.
    This works even after a reboot. (on windows 7).
    Sunday, October 04, 2009 2:17 PM
  • Say Chappy1-- is it "normal" for this service to consume 50% of CPU for minutes at a time? I'm running an Intel Core2Duo E4500 @ 2.2GHz with 4 GB RAM (3.25 usable) on an Abit AB9 Quad GT main board. The CPU utilization seems excessive and noticeably slows the performance of an otherwise capable system. I have the service turned off as you instructed in the other responses, but for some reason it's still active. Any thoughts? Thanks!
    Saturday, February 13, 2010 7:58 PM