Link to home
Start Free TrialLog in
Avatar of LeTay

asked on

Strange iphist.dat file appearing. Delphi related ?

Sometime, an empty file named iphist.dat appears either on the Windows desktop, or in a folder where I have a Delphi project, or in the folder where I copy the project EXE file.
My anti-virus avast! does not detect any virus on my computer...
What is that file ?
Is there anyway something worst than a virus on my PC ?
Avatar of jimyX

Your System is infected by Aphex Worm.

I stopped using Avast since 2006. I am using Avira and I believe it's much more powerful than Avast.
It's not Delphi related. Delphi has nothing to do with it, except that the worm keeps spreading over the folder/exe you access.
Avatar of LeTay


Does not seem to be that worm : none of the file to be deleted, according to "how to remove it" does exist !
It certainly seems to be some sort of worm, maybe a successor of aphex. Did you do a scan during boot with avast? Is there anything in the iphist file?
Avatar of LeTay


The file is empty
I don't know how I can do a scan with avast at boot time
Open Avast interface, select scan, select boot-time scan from the drop down list, press start.

If nothing is found, it's wise to try with another virus scanner. Not that Avast is bad, but no single virus scanner gets everything.
it's the indy component for resolving or monitoring ip adresses which creates this file
normally this is in the .exe directory

my best guess is an app uses
TIdIPWatch or TIdIpAddrMon
Very interesting Geert, especially since the same file is associated with some worms, you wonder if that's coincidence or not ;)
Avatar of Geert G
Geert G
Flag of Belgium image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I never stopped thinking, I just never use Indy ;)

Google for iphist.dat and you'll hit info about worms, not about Indy :p
Avatar of LeTay


I do not use that indy component !
Will start a full scan tonight
Avatar of LeTay


Sorry about that, I found I use that tidipwatch !
I will modify the properties and watch what happens
Avatar of LeTay


I change the property and indeed the file was that one !
Many thanks