Firewall complains about my project requiring net access.

[chronozphere]

Hey everyone

During the past few day's my projects seem to need an internet connection. Sometimes, when I want to run my code, a firewall message pops up, saying that the executable needs access. At this moment, my DeleD code tries to access 192.168.1.37 with the ICMP protocol (I think 192.168.1.37 is localhost in my case).

I'm using Turbo Delphi 2006, and AFAIK "W32/Induc-A" (That bloody delphi virus) can only infect Delphi 4-7.

How can this happen? Should I be worried?

Thanks

[User137]

In theory processes can use sockets to communicate, but i've never seen anyone do that. You say "my DeleD code" so this is happening when you compile and run application without you intentionally opening any connection in code? Some of your components or code somewhere is trying to open socket.

[paul_nicholls]

Hey everyone

During the past few day's my projects seem to need an internet connection. Sometimes, when I want to run my code, a firewall message pops up, saying that the executable needs access. At this moment, my DeleD code tries to access 192.168.1.37 with the ICMP protocol (I think 192.168.1.37 is localhost in my case).

I'm using Turbo Delphi 2006, and AFAIK "W32/Induc-A" (That bloody delphi virus) can only infect Delphi 4-7.

How can this happen? Should I be worried?

Thanks

Are you compiling your UV plugin, or DeleD CE itself?

Have you tried scanning your plugin or DeleD executable for some virus (W32/Induc-A) or otherwise?

cheers,
Paul

[AthenaOfDelphi]

I would definitely take a close look at all the library files for Delphi to check that none of them have been modified. That dammed virus has been in the wild for a while, so it's possible that some git (Delphi is quite popular amongst script kiddies etc. I believe) has modified it to work with newer versions and has possibly include some sort of payload that does more than infect Delphi installations.

Please let us know what you find so we can all keep a look out for it.

[chronozphere]

Are you compiling your UV plugin, or DeleD CE itself?

Have you tried scanning your plugin or DeleD executable for some virus (W32/Induc-A) or otherwise?

I was compiling DeleD CE.

The full AVG scan just completed. No virus found. I'll run another test soon to specifically check my delphi install.

The problem with this thing is that it doesnt happen very often. I can't really reproduce this to see where it comes from. :?

[chronozphere]

It just happened again?

Any ways of tracking down the responsible code? It frustrates me to see the firewall window pop up, without being able to trace it (I need to see the callstack or something).

[JSoftware]

You could look around for calls to IcmpSendEcho in the rtl or the code you use. Eventually you could use a library tracer to see if your program dynamically links to Iphlpapi.dll somehow

[AthenaOfDelphi]

If it's in Delphi, compile with the debug DCUs and step through it using the debugger? Thats what I'd do.

[chronozphere]

If it's in Delphi, compile with the debug DCUs and step through it using the debugger? Thats what I'd do.

The problem is not reproducable, so I guess I'll be stepping for ages before it finally happens. I need a way to check the state of my program when my firewall complains.

Maybe I should use "pause" or something.

[User137]

Search all your project files for 192.168.1.37, or even deep harddisk search for text.