Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission

#1

My apologies, that should read VFP6 sp3.
Thanks
Paul

#2

In article <pbvviv81bmq1gqk88nes74kaktj9m6hjee (AT) 4ax (DOT) com>,
PB <pbadger (AT) pitt (DOT) edu.REMOVE> wrote:

Quote:

I have prepared a small foxpro (version 6.0 sp 5 installed)
application for in-house use to maintain a database of stock items.
This application was not intentionally designed to send information
over the network, but my firewall keeps reporting that the stand alone
application that I prepared is attempting to send data over the
network.
Is anyone aware of similar behavior. Is this normal? I am not aware
of this happening on the design computer where the code is written and
tested.

I've never heard of this before. Does your machine have a virus, maybe?

#3

On 5 Aug 2003 16:11:58 -0600, gfitzger (AT) nyx10 (DOT) nyx.net (Garrett
Fitzgerald) wrote:

Quote:

I've never heard of this before. Does your machine have a virus, maybe?

I have a recent version of Norton Antivirus installed and it has not
reported any virus. I was wondering the same thing, but I had never
heard of a virus targeting Foxpro Applications.
I just ran a scan on all windows directories and the directories that
my application is in and Norton indicates that all the files are
clean.

Sygate firewall reports the network traffic like this:
(I have altered the source IP address for security reasons)

File Version : 4.12.34
File Description :
File Path : D:\Inv\inv.exe
Process ID : FFFAD4DD (Heximal) 4294628573 (Decimal)

Connection origin : local initiated
Protocol : UDP
Local Address : *.142.153.79
Local Port : 137
Remote Name :
Remote Address : 200.171.246.133
Remote Port : 1034

Ethernet packet details:
Ethernet II (Packet Length: 271)
Destination: 00-d0-04-6a-80-0a
Source: 52-54-00-e0-54-ba
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0xb831 (Correct)
Source: *.142.153.79
Destination: 200.171.246.133
User Datagram Protocol
Source port: 137
Destination port: 1034
Length: 8
Checksum: 0x84a8 (Correct)
Data (237 Bytes)

#4

Hello, PB !
You wrote:

Port 137 is ms networking (netbios). It's the app talking to a
share on the other computer. You need to tell it to let that
through as it's normal.

Quote:

On 5 Aug 2003 16:11:58 -0600, gfitzger (AT) nyx10 (DOT) nyx.net (Garrett
Fitzgerald) wrote:

I've never heard of this before. Does your machine have a
virus, maybe?

I have a recent version of Norton Antivirus installed and it
has not
reported any virus. I was wondering the same thing, but I had
never
heard of a virus targeting Foxpro Applications.
I just ran a scan on all windows directories and the
directories that
my application is in and Norton indicates that all the files
are
clean.

Sygate firewall reports the network traffic like this:
(I have altered the source IP address for security reasons)

File Version : 4.12.34
File Description :
File Path : D:\Inv\inv.exe
Process ID : FFFAD4DD (Heximal) 4294628573 (Decimal)

Connection origin : local initiated
Protocol : UDP
Local Address : *.142.153.79
Local Port : 137
Remote Name :
Remote Address : 200.171.246.133
Remote Port : 1034

Ethernet packet details:
Ethernet II (Packet Length: 271)
Destination: 00-d0-04-6a-80-0a
Source: 52-54-00-e0-54-ba
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0xb831 (Correct)
Source: *.142.153.79
Destination: 200.171.246.133
User Datagram Protocol
Source port: 137
Destination port: 1034
Length: 8
Checksum: 0x84a8 (Correct)
Data (237 Bytes)

--

Cyrus Welch
Senior Programmer
MetSYS Inc
http://www.metsysinc.com

#5

On Fri, 08 Aug 2003 19:14:38 GMT, cywelch (AT) hotmail (DOT) com (Cyrus Welch)
wrote:

That is interesting. But why would my application be trying to talk to
a share on another computer. The application is single user and should
not need any information on any outside computers, especially one
outside my local domain.

Why would microsoft allow compiled Foxpro applications to initiate
network communications in an undocumented manner, or is this network
traffic related to the SET REFRESH command.

Just curious. For now I think that I will keep blocking this traffic
since I do not understand the reason behind it.

Quote:

Hello, PB !
You wrote:

Port 137 is ms networking (netbios). It's the app talking to a
share on the other computer. You need to tell it to let that
through as it's normal.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission

comp.databases.xbase.fox comp.databases.xbase.fox

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission - 08-05-2003 , 04:15 PM

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission - 08-05-2003 , 05:11 PM

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission - 08-06-2003 , 11:15 AM

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission - 08-08-2003 , 02:14 PM

Re: Unusual Foxpro Application behavior, attempting to send network traffic without permission - 08-11-2003 , 07:05 AM