I started today Gothic 1 after a two week break. Firewall warned me right away that gothic.exe (with gogwrap.exe as a parent) tries to connect to the internet, first to crl.microsoft.com, then to www.symantec.com and afterward to i1.services.social.microsoft.com!
I denied the connection attempt but is very wired. Didn't happened before and I've had the same firewall software.
Have you seen this before?...
edit: Anti virus says that the exe is clean.
edit2: Strange, every time I start Gothic it tries to connect but there is no strict order for the sites where it tries to connect. Sometimes will only try to connect to crl.microsoft.com (which is always first). I've seen a new one also: i4.services.social.microsoft.com. Firewall says all connections are on HTTP port 80. Very strange, I'm tempted to allow the connection and see what happens.

Apparently it's a side effect of having Norton installed. Check the thread below (it's in German, but you can always use Google translate):
http://forenarchiv.worldofplayers.de/thread.php?id=215223&post=502994
Another thread (Gothic 2, but the same behavior - with a response from Jowood itself):
http://forum.jowood.com/showthread.php?t=110503

Thank you for the links.
The second one seems to explain this behavior. It seems that sometimes the OS (Win XP pro SP3 in my case) can trigger a connection to crl.microsoft.com in order to check the certificate revocation list.
I use BitDefender antivirus/firewall and never had installed NAV on this machine. It's even more strange that it tried to connect also to symantec.com, but this happened only once after some unsuccessful attempts to connect to crl.microsoft.com. Maybe it's just a way to check if the internet connection exists at all... :)