Non-internet application wants to connect over internet

[Tom Dacon]

I have a little desktop application (it happens to be a Windows Forms analog
clock) that's written in VB.Net (2003). I placed a shortcut in my Startup
program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it starts
up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen
when the app has been freshly rebuilt, but after a few days or so it starts
to try to connect and thereafter tries again each time the app is started
up.

Thinking that I might have acquired some new kind of virus that attaches
itself to .Net executables, I made a note of the file size and the 'last
modified' date after a fresh build, and then checked it again after the
executable started wanting to connect to the internet. No changes. Norton
AntiVirus 2003 with the most recent updates shows a clean scan. I always
tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Wayne P.]

Tom,

I really don't know for sure, but this is the first thing that comes to
mind. Did you use any 3rd party components when writing your clock app? I
have heard of some 3rd party components calling home for license
verification when on the development machine. If you used a 3rd party
component, and ran the program on the development machine (even outside the
IDE), the development license could be found on the machine and applied,
thus wanting the internet. The only way to be sure is to contact the vendor
and hope they don't lie.

Although if you haven't used any 3rd party components, then obviously the
above is not the case. And if you did - it does not explain why your app
only starts this strange behaviour a few days later....

Wayne P.
"Tom Dacon" <td****@community.nospam> wrote in message
news:Oe**************@TK2MSFTNGP15.phx.gbl...

I have a little desktop application (it happens to be a Windows Forms analog clock) that's written in VB.Net (2003). I placed a shortcut in my Startup
program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it starts up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen
when the app has been freshly rebuilt, but after a few days or so it starts to try to connect and thereafter tries again each time the app is started
up.

Thinking that I might have acquired some new kind of virus that attaches
itself to .Net executables, I made a note of the file size and the 'last
modified' date after a fresh build, and then checked it again after the
executable started wanting to connect to the internet. No changes. Norton
AntiVirus 2003 with the most recent updates shows a clean scan. I always
tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Tom Dacon]

A good point, and one that didn't occur to me, but in this case there's no
third-party component being used in the application. It's based on some
sample code from Microsoft - I don't remember exactly where I got it; maybe
it was a framework sample or something, and it's all just plain vanilla
VB.Net and framework classes.

However, I've modified it to use the Microsoft Office 11 Object Library
(Office 2003), in order to interrogate the user's (my) Outlook appointments
calendar. Periodically I get the appointments from Office and display on the
clock face little icons that represent the starting time of the
appointments, with tooltips that display the details. I suppose it's
remotely possible that somehow I'm 'waking up' Outlook, and it's going out
to try to download email, but it sounds pretty unlikely.

And of course, as you say, none of this explains why it starts behaving this
way only after the passage of some time.

A puzzle.

Thanks for your comments.

Tom Dacon
Dacon Software Consulting

"Wayne P." <in******@nospam-totalink.net> wrote in message
news:%2******************@TK2MSFTNGP15.phx.gbl...

Tom,

I really don't know for sure, but this is the first thing that comes to
mind. Did you use any 3rd party components when writing your clock app? I have heard of some 3rd party components calling home for license
verification when on the development machine. If you used a 3rd party
component, and ran the program on the development machine (even outside the IDE), the development license could be found on the machine and applied,
thus wanting the internet. The only way to be sure is to contact the vendor and hope they don't lie.

Although if you haven't used any 3rd party components, then obviously the
above is not the case. And if you did - it does not explain why your app
only starts this strange behaviour a few days later....

Wayne P.
"Tom Dacon" <td****@community.nospam> wrote in message
news:Oe**************@TK2MSFTNGP15.phx.gbl...

I have a little desktop application (it happens to be a Windows Forms

analog

clock) that's written in VB.Net (2003). I placed a shortcut in my Startup program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it

starts

up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen when the app has been freshly rebuilt, but after a few days or so it

starts

to try to connect and thereafter tries again each time the app is started up.

Thinking that I might have acquired some new kind of virus that attaches
itself to .Net executables, I made a note of the file size and the 'last
modified' date after a fresh build, and then checked it again after the
executable started wanting to connect to the internet. No changes. Norton AntiVirus 2003 with the most recent updates shows a clean scan. I always
tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Wayne P.]

Tom,

I'm not an Office / Outlook / VBA expert - but your thought on the email
gave me an idea - is your calendar setup via an Exchange server at all?
Perhaps the query of calendar items is causing this. I'm thinking that some
of the calendar items may be cached, but a few days later the cache expires
or new appointments are made that need downloaded, thus wanting a remote
connection (internet) to the exchange server.

Of course, this is all pure speculation. I don't know - hopefully someone
else will chime in....

Good luck!

Wayne P.

"Tom Dacon" <td****@community.nospam> wrote in message
news:ui*************@TK2MSFTNGP12.phx.gbl...

A good point, and one that didn't occur to me, but in this case there's no
third-party component being used in the application. It's based on some
sample code from Microsoft - I don't remember exactly where I got it; maybe it was a framework sample or something, and it's all just plain vanilla
VB.Net and framework classes.

However, I've modified it to use the Microsoft Office 11 Object Library
(Office 2003), in order to interrogate the user's (my) Outlook appointments calendar. Periodically I get the appointments from Office and display on the clock face little icons that represent the starting time of the
appointments, with tooltips that display the details. I suppose it's
remotely possible that somehow I'm 'waking up' Outlook, and it's going out
to try to download email, but it sounds pretty unlikely.

And of course, as you say, none of this explains why it starts behaving this way only after the passage of some time.

A puzzle.

Thanks for your comments.

Tom Dacon
Dacon Software Consulting

"Wayne P." <in******@nospam-totalink.net> wrote in message
news:%2******************@TK2MSFTNGP15.phx.gbl...

Tom,

I really don't know for sure, but this is the first thing that comes to
mind. Did you use any 3rd party components when writing your clock app?

I

have heard of some 3rd party components calling home for license
verification when on the development machine. If you used a 3rd party
component, and ran the program on the development machine (even outside

the

IDE), the development license could be found on the machine and applied,
thus wanting the internet. The only way to be sure is to contact the

vendor

and hope they don't lie.

Although if you haven't used any 3rd party components, then obviously the

above is not the case. And if you did - it does not explain why your app only starts this strange behaviour a few days later....

Wayne P.
"Tom Dacon" <td****@community.nospam> wrote in message
news:Oe**************@TK2MSFTNGP15.phx.gbl...

I have a little desktop application (it happens to be a Windows Forms

analog

clock) that's written in VB.Net (2003). I placed a shortcut in my

Startup program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it

starts

up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen when the app has been freshly rebuilt, but after a few days or so it

starts

to try to connect and thereafter tries again each time the app is started up.

Thinking that I might have acquired some new kind of virus that attaches itself to .Net executables, I made a note of the file size and the 'last modified' date after a fresh build, and then checked it again after the executable started wanting to connect to the internet. No changes. Norton AntiVirus 2003 with the most recent updates shows a clean scan. I always tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Kevin Yu [MSFT]]

Hi Tom,

First of all, I would like to confirm my understanding of your issue. From
your description, I understand that when your clock application starts, the
Norton firewall blocks it because the app is trying to access internet. If
there is any misunderstanding, please feel free to let me know.

Based on my experience, there might be many possibilities. Most common is
third-party components and virus. If the app will be blocked on startup,
will it be blocked if you start it manually by double clicking the icon?

If anything is unclear, please feel free to reply to the post.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Tom Dacon]

> First of all, I would like to confirm my understanding of your issue. From

your description, I understand that when your clock application starts, the Norton firewall blocks it because the app is trying to access internet. If
there is any misunderstanding, please feel free to let me know.
Correct, the app starts and the Norton firewall dialog comes up immediately,
telling me that the app is trying to access the internet. I select 'block
access' and continue, and the app proceeds to run normally.
Based on my experience, there might be many possibilities. Most common is
third-party components and virus. If the app will be blocked on startup,
will it be blocked if you start it manually by double clicking the icon?

The application is straight VB.Net and framework classes, but as I mentioned
in another post I use the Microsoft Office 11 Object Library (Office 2003)
in order to get to my Outlook calendar. I get the day's appointments from
the calendar and display on the clock face little icons that represent the
starting time of the appointments.

Here's some of the code of my Outlook interface class:

Imports Microsoft.Office.Interop

Public Sub New()
Try
OutlookApp = New Outlook.Application
MapiNameSpace = OutlookApp.GetNamespace("MAPI")
Catch ex As Exception
Throw new ApplicationException("Can't get to Outlook", ex)
End Try
End Sub

Private OutlookApp As Outlook.Application
Private MapiNameSpace As Outlook.NameSpace

Then there's other code that gets the Calendar folder from the MAPI
namespace object and retrieves the calendar items under a date restriction
clause.

I'm fairly certain that I've ruled out a .Net-specific virus, but of course
there's no way to be 100% sure of that. A virus scan with Norton Antivirus
and up-to-date definitions comes up clean. More and more, it's beginning to
look like it's Outlook that's doing it.

Does instantiating a new Outlook application object actually start up the
entire full-function Outlook application (without the user interface)? If
this is so, maybe Outlook is just going about its business trying to
retrieve email from the mail server, and because it's running under the
clock application the firewall is telling me it's the clock. Could that be
what's going on?

Thanks,
Tom

[Ignacio Machin \( .NET/ C# MVP \)]

Hi,

Where its trying to connect?

If it's an IP do a tracert and see if you determine where it goes.

cheers,

--
Ignacio Machin,
ignacio.machin AT dot.state.fl.us
Florida Department Of Transportation
"Tom Dacon" <td****@community.nospam> wrote in message
news:Oe**************@TK2MSFTNGP15.phx.gbl...

I have a little desktop application (it happens to be a Windows Forms analog clock) that's written in VB.Net (2003). I placed a shortcut in my Startup
program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it starts up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen
when the app has been freshly rebuilt, but after a few days or so it starts to try to connect and thereafter tries again each time the app is started
up.

Thinking that I might have acquired some new kind of virus that attaches
itself to .Net executables, I made a note of the file size and the 'last
modified' date after a fresh build, and then checked it again after the
executable started wanting to connect to the internet. No changes. Norton
AntiVirus 2003 with the most recent updates shows a clean scan. I always
tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Tom Dacon]

Tracecert...OK, I'll go find about that tool and see what it shows me.

Thanks,
Tom Dacon

"Ignacio Machin ( .NET/ C# MVP )" <ignacio.machin AT dot.state.fl.us> wrote
in message news:u0**************@TK2MSFTNGP10.phx.gbl...

Hi,

Where its trying to connect?

If it's an IP do a tracert and see if you determine where it goes.

cheers,

--
Ignacio Machin,
ignacio.machin AT dot.state.fl.us
Florida Department Of Transportation
"Tom Dacon" <td****@community.nospam> wrote in message
news:Oe**************@TK2MSFTNGP15.phx.gbl...

I have a little desktop application (it happens to be a Windows Forms

analog

clock) that's written in VB.Net (2003). I placed a shortcut in my Startup program group to start it up when I log on. I have put no code in the
application whatsoever to do internet communications, and yet when it

starts

up at logon I've begun getting notification dialogs from my software
firewall that the app wants to connect to the internet. It doesn't happen when the app has been freshly rebuilt, but after a few days or so it

starts

to try to connect and thereafter tries again each time the app is started up.

Thinking that I might have acquired some new kind of virus that attaches
itself to .Net executables, I made a note of the file size and the 'last
modified' date after a fresh build, and then checked it again after the
executable started wanting to connect to the internet. No changes. Norton AntiVirus 2003 with the most recent updates shows a clean scan. I always
tell the firewall (Norton Personal Firewall 2003) to block the
communication, and the application continues to execute normally.

Has anyone else seen similar behavior in non-communications-enabled
applications, or know of anything that might shed some light on this
behavior?

Thanks,
Tom Dacon
Dacon Software Consulting

[Kevin Yu [MSFT]]

Hi Tom,

I think starting outlook is why you clock application is connecting to
internet. When you're creating an Outlook.Application object like the
following, as you know, it is starting the entire full-function Outlook
instance.

OutlookApp = New Outlook.Application

It is the Outlook which is trying to connect to mail server to check email.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Tom Dacon]

OK, this is good enough for me. As long as I know why it's happening, I'm
fine with it. I just don't want any unknown outgoing traffic going on in my
machine that I don't understand.

Thanks for the help,

Tom Dacon
Dacon Software Consulting

"Kevin Yu [MSFT]" <v-****@online.microsoft.com> wrote in message
news:fP**************@cpmsftngxa10.phx.gbl...

Hi Tom,

I think starting outlook is why you clock application is connecting to
internet. When you're creating an Outlook.Application object like the
following, as you know, it is starting the entire full-function Outlook
instance.

OutlookApp = New Outlook.Application

It is the Outlook which is trying to connect to mail server to check email.
Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."