Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Strange iphist.dat file appearing. Delphi related ?

Posted on 2013-12-07
14
2,478 Views
Last Modified: 2013-12-11
Sometime, an empty file named iphist.dat appears either on the Windows desktop, or in a folder where I have a Delphi project, or in the folder where I copy the project EXE file.
My anti-virus avast! does not detect any virus on my computer...
What is that file ?
Is there anyway something worst than a virus on my PC ?
0
Comment
Question by:LeTay
  • 5
  • 4
  • 3
  • +1
14 Comments
 
LVL 24

Expert Comment

by:jimyX
ID: 39702995
Your System is infected by Aphex Worm.

I stopped using Avast since 2006. I am using Avira and I believe it's much more powerful than Avast.
0
 
LVL 24

Expert Comment

by:jimyX
ID: 39702996
It's not Delphi related. Delphi has nothing to do with it, except that the worm keeps spreading over the folder/exe you access.
0
 
LVL 24

Expert Comment

by:jimyX
ID: 39703001
0
Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

 

Author Comment

by:LeTay
ID: 39703104
Does not seem to be that worm : none of the file to be deleted, according to "how to remove it" does exist !
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39703436
It certainly seems to be some sort of worm, maybe a successor of aphex. Did you do a scan during boot with avast? Is there anything in the iphist file?
0
 

Author Comment

by:LeTay
ID: 39704032
The file is empty
I don't know how I can do a scan with avast at boot time
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39705551
Open Avast interface, select scan, select boot-time scan from the drop down list, press start.

If nothing is found, it's wise to try with another virus scanner. Not that Avast is bad, but no single virus scanner gets everything.
0
 
LVL 37

Expert Comment

by:Geert Gruwez
ID: 39710729
it's the indy component for resolving or monitoring ip adresses which creates this file
normally this is in the .exe directory

my best guess is an app uses
TIdIPWatch or TIdIpAddrMon
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39710732
Very interesting Geert, especially since the same file is associated with some worms, you wonder if that's coincidence or not ;)
0
 
LVL 37

Accepted Solution

by:
Geert Gruwez earned 500 total points
ID: 39710748
why is it that when the asker adds 'Virus' to the question that everybody stops thinking ?

i came across this same behaviour too for the file iphist.dat
if you want to have the virus scanner react to a worm or viurs  
why not set the property correct of the IPWatch component

 bad properties
this is the original property value ... héhé
ipwatch properties
0
 
LVL 19

Expert Comment

by:MerijnB
ID: 39710753
I never stopped thinking, I just never use Indy ;)

Google for iphist.dat and you'll hit info about worms, not about Indy :p
0
 

Author Comment

by:LeTay
ID: 39710805
I do not use that indy component !
Will start a full scan tonight
0
 

Author Comment

by:LeTay
ID: 39710810
Sorry about that, I found I use that tidipwatch !
I will modify the properties and watch what happens
0
 

Author Closing Comment

by:LeTay
ID: 39710982
I change the property and indeed the file was that one !
Many thanks
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
One of the biggest threats facing all high-value targets are APT's.  These threats include sophisticated tactics that "often starts with mapping human organization and collecting intelligence on employees, who are nowadays a weaker link than network…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question