The "drummer" is inside every program. Is this normal?

#1 · October 8, 2022, 8:44 pm

Colleagues, through the analyzer virustotal.com was able to establish that any application compiled in VisualNeoWin is seen in a network connection to one or more of these addresses :

13.107.*.*:80 (TCP) United States Microsoft Corporation
20.99.*.*:443 (TCP) United States Microsoft Corporation
23.216.147.*:443 (TCP) United States Akamai Technologies, Inc.

In other words, there is always a "drummer" inside your program.

Vadim and fkapnist have reacted to this post.

#2 · October 8, 2022, 9:43 pm

Windows detects program crashes and sends error reports to Microsoft.

Akamai is probably the parent CloudNEO Hosting Website.

....

neoEdge.exe once displayed some strange rectangles on my PC.

It has been updated since then and the rectangles are gone,

but I wonder if some antivirus software may interpret it as monitoring users' online activities without their knowledge?

Vadim and Darbdenral have reacted to this post.

#3 · October 8, 2022, 10:52 pm

I believe that the IP address belongs to Akamai, which is a company Microsoft uses to manage traffic to their servers. Maybe something crashed on their server during all their tests, so error reporting maybe catches it and their Windows server sends a report to Microsoft? Just a guess..

Vadim and fkapnist have reacted to this post.

#4 · October 9, 2022, 9:25 am

@leopold

Hi! Apparently this happens not only with VisualNEO Win projects, because I compile NeoCommands in NeoBook (due to the fact that the new version of VisualNEO Win displays tips for hotkeys in the main application menu in German, and I need it in English).

fkapnist and Darbdenral have reacted to this post.

#5 · October 11, 2022, 4:39 pm

I can confirm VisualNEO compiled programs are not doing any kind of connections to any remote host.
I think it's probably Windows itself checking whatever...

Vadim, fkapnist and Darbdenral have reacted to this post.

#6 · October 11, 2022, 6:23 pm

@luishp

I think it's not Windows, but one of the modules on which VisualNEO is based.

I checked it with other known programs and no network activity is registered in them.
This is easy to check with the service

https://www.virustotal.com/gui/home/upload

fkapnist has reacted to this post.

#7 · October 11, 2022, 8:13 pm

VirusTotal is interesting but it seems that almost everything gets flagged!

I tested the "Cool Calculator" exe sample of VisualNEO Web and it found (4)

Freebasic (0)

Lazarus (0)

pdScript (1)

Purebasic (5)

thinBasic (8)

AutoIt (6)

Only the executables compiled in Freebasic and Lazarus were "clean."

Vadim and Darbdenral have reacted to this post.

#8 · October 12, 2022, 1:38 am

Neobook 5 was clean

VisualNEO Win had 2 flags

Uploaded files:

#9 · October 12, 2022, 7:27 am

@fkapnist

You are talking about virus detection,
but the original topic was about the network behavior of programs.

Or did I misunderstand you?

fkapnist has reacted to this post.

#10 · October 12, 2022, 7:34 am

Quote from leopold on October 12, 2022, 7:27 am

@fkapnist

You are talking about virus detection,
and the original topic was about the network behavior of programs.

Or did I misunderstand you?

Neither Neobook or VisualNEO Win showed any network activity in my scans.

#11 · October 12, 2022, 4:19 pm

I compiled a simple executable (an alertbox) both with Neobook5 and with VisualNeo Win.

Here are the results from VirusTotal:

---

exe compiled with Neobook.exe (found 2 virus alerts)

1. Jiangmin -- Trojan.Qhost.fd

2. MaxSecure -- Trojan.Malware.300983.susgen

No Network Communication

---------------------------------------------------------

exe compiled with VisualNEOWin.exe (found 3 viruses)

1. MaxSecure -- Trojan.Malware.300983.susgen

2. SecureAge -- Malicious

3. Zillya -- Adware.Generic.Win32.173390

Network Communication
IP Traffic

Contacted IP Addresses (1)
IP Detections Autonomous System Country
20.99.184.37 0/ 95 8075 US

-----------------------------

When I added a WebBrowser Object to VisualNEO Win, the IP traffic apparently increased:

Network Communication
IP Traffic
192.168.0.1:137 (UDP)
20.99.184.37:443 (TCP)
23.216.147.76:443 (TCP)

---------------

@leopold

So, it seems that VisualNeoWin does contact an IP address, but Neobook5 did not.

Thanks for the info.

#12 · October 14, 2022, 2:12 pm

This is quite strange. I'm sure there is not any connection to any host from VisualNEO Win source code.
In fact VisualNEO Win and NeoBook source code are almost the same.
The given IP's seems to be owned by Microsoft.

Vadim and fkapnist have reacted to this post.

#13 · October 14, 2022, 4:22 pm

Quote from luishp on October 14, 2022, 2:12 pm

This is quite strange. I'm sure there is not any connection to any host from VisualNEO Win source code.
In fact VisualNEO Win and NeoBook source code are almost the same.
The given IP's seems to be owned by Microsoft.

Neobook and VisualNEO Win have different registration methods.

Neobook has only one Key.

VisualNEO Win has a different Key for each installation. Maybe it uses a script to validate registration online?

.

#14 · October 14, 2022, 8:01 pm

Maybe it uses a script to validate registration online?

No.

fkapnist has reacted to this post.

The "drummer" is inside every program. Is this normal? - Forum

The "drummer" is inside every program. Is this normal?