everybyte

Hello there, I compile an application in Delphi CE that explicitly accesses only localhost using TNetHTTPRequest.Get method. However a test by VirusTotal.com reveals that application accesses a bunch of unknown IP addresses: IP Traffic 192.229.211.108:80 (TCP) 20.99.184.37:443 (TCP) 20.99.185.48:443 (TCP) 20.99.186.246:443 (TCP) 209.197.3.8:80 (TCP) 23.216.147.64:443 (TCP) What could be the reason for this?

I have Windows 11 preinstalled so I assume it is on default settings. The funny thing I didn't explain good enough is that ProcMon64.exe starts ok, while SysMon.64exe has a problem.

Funny that SysMon64.exe could not start in Windows 11 - there was a just screen flash. When opening UAC stated that the app is from an unknown publisher although in properties it is actually properly signed.

A console "Hello World" application compiled in Delphi 7 shows the same access pattern in VirusTotal.com test (IPv6 UDP address is different). I consider at this point that IP access behavior is an artifact of a testing environment.

It is an issue in the sense that advanced users suspect a nefarious activity in your application.

@mvanrijnen: Thanks for suggestion about Process Monitor, but it did not reveal suspicious activity as reported by VirusTotal. I also tried Fiddler, which is capable of monitoring per application, but it only seems to support HTTP and HTTPS. Trying to find anything with Wireshark.

A simple console application (compiled in Delphi CE 10.4) that does a single console WriteLn when checked in virustotal.com sandbox is seen accessing three IP addresses: 192.229.211.108:80 (TCP) Edgecast Networks 20.99.184.37:443 (TCP) Computer Sciences Corporation a83f:8110:0:0:100:0:1800:0:53 (UDP) This network is not allocated. This object is here for Database consistency and to allow hierarchical authorisation checks.

VirusTotal.com has a BEHAVIOR tab where application is tested for network access among other things. If strange IP access is from WinInet then it is kind of "legal" trojan behavior.

Also the caption height of the form with BorderStyle = bsDialog is bigger in Delphi 11 compared to 10.4, while form height is smaller:

We used a workaround in our application to make a smooth transition from one monitor to another. I think the problem is not so much as refresh time but the fact that refresh kicks in when crossing monitor boundary. As a result user cannot continue moving the form (for refresh period) and this does not feel right. For smooth transition we detect the start of crossing using WM_ENTERSIZEMOVE and WM_MOVING. At that moment we ensure that the form does not update (e.g. WM_SETREDRAW) . Once movement is finished (WM_EXITSIZEMOVE) we let the form update. Still a lot of code gets executed even without refresh, so an additional trick was helpful. In our case the content of the MainForm was on an embedded form, so on crossing we set embedded form invisible and without parent. In that case it was not scaled so we avoided this on crossing. After crossing was finished we reinstated content visibility and the parent, which finished the scaling. To improve visual outlook we captured content onto scaled TImage and put it on top of the MainForm. As a result only TImage gets quickly scaled on crossing and provides (possibly blurred) visual feedback until content finishes scaling and is ready to show.