Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Strange iphist.dat file appearing. Delphi related ?

Posted on 2013-12-07
14
Medium Priority
?
2,689 Views
Last Modified: 2013-12-11
Sometime, an empty file named iphist.dat appears either on the Windows desktop, or in a folder where I have a Delphi project, or in the folder where I copy the project EXE file.
My anti-virus avast! does not detect any virus on my computer...
What is that file ?
Is there anyway something worst than a virus on my PC ?
0
Comment
Question by:LeTay
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
  • +1
14 Comments
 
LVL 24

Expert Comment

by:jimyX
ID: 39702995
Your System is infected by Aphex Worm.

I stopped using Avast since 2006. I am using Avira and I believe it's much more powerful than Avast.
0
 
LVL 24

Expert Comment

by:jimyX
ID: 39702996
It's not Delphi related. Delphi has nothing to do with it, except that the worm keeps spreading over the folder/exe you access.
0
 
LVL 24

Expert Comment

by:jimyX
ID: 39703001
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:LeTay
ID: 39703104
Does not seem to be that worm : none of the file to be deleted, according to "how to remove it" does exist !
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39703436
It certainly seems to be some sort of worm, maybe a successor of aphex. Did you do a scan during boot with avast? Is there anything in the iphist file?
0
 

Author Comment

by:LeTay
ID: 39704032
The file is empty
I don't know how I can do a scan with avast at boot time
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39705551
Open Avast interface, select scan, select boot-time scan from the drop down list, press start.

If nothing is found, it's wise to try with another virus scanner. Not that Avast is bad, but no single virus scanner gets everything.
0
 
LVL 38

Expert Comment

by:Geert Gruwez
ID: 39710729
it's the indy component for resolving or monitoring ip adresses which creates this file
normally this is in the .exe directory

my best guess is an app uses
TIdIPWatch or TIdIpAddrMon
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39710732
Very interesting Geert, especially since the same file is associated with some worms, you wonder if that's coincidence or not ;)
0
 
LVL 38

Accepted Solution

by:
Geert Gruwez earned 2000 total points
ID: 39710748
why is it that when the asker adds 'Virus' to the question that everybody stops thinking ?

i came across this same behaviour too for the file iphist.dat
if you want to have the virus scanner react to a worm or viurs  
why not set the property correct of the IPWatch component

 bad properties
this is the original property value ... héhé
ipwatch properties
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39710753
I never stopped thinking, I just never use Indy ;)

Google for iphist.dat and you'll hit info about worms, not about Indy :p
0
 

Author Comment

by:LeTay
ID: 39710805
I do not use that indy component !
Will start a full scan tonight
0
 

Author Comment

by:LeTay
ID: 39710810
Sorry about that, I found I use that tidipwatch !
I will modify the properties and watch what happens
0
 

Author Closing Comment

by:LeTay
ID: 39710982
I change the property and indeed the file was that one !
Many thanks
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
One of the biggest threats facing all high-value targets are APT's.  These threats include sophisticated tactics that "often starts with mapping human organization and collecting intelligence on employees, who are nowadays a weaker link than network…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
In this video, Percona Solution Engineer Rick Golba discuss how (and why) you implement high availability in a database environment. To discuss how Percona Consulting can help with your design and architecture needs for your database and infrastr…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question