Is Microsoft using a TCP connection in a simple C program?-CodePudding

This question was

Link to VirusTotal analysis: virustotal-analysis

I will share the code but there is no mystery in it:

#include <stdio.h>

int main() {

    printf("Hello, World!\n");

    return 0;
}

CodePudding user response：

The report of Virustotal is misleading. The report does not show what the program itself has done, but includes also some effects happened in the operating system, in this case Windows, that are not specific to the program that was executed.

I have just create an executable with your code and uploaded to Virustotal. It showed connections to 2 IPs - one the same as yours and one certificate to an Akamai server. Also CSV files were created and deleted, as in your case. Virustotal just reports all changes, even if they are irrelevant to the program.

I have started Fiddler. It shows all connections from all programs. Then I have executed the same program locally many times. It has never established any network connections. But in that time Windows itself has established some connections, e.g. to a Microsoft license server.

TLDR

The report of Virustotal is formally not wrong, but misleading, since its report can easily be misinterpreted.

CodePudding user response：

Hmm..., I would blame neither the C program not the antivirus. But Windows 10 comes with a security feature: every new program is first sended for analysis to a Microsoft server to first see whether it is or not a well known malware.

It is certainly an interesting feature for programs that you have downloaded from random places, but can be seen as a rather annoying one for locally built programs: you should know what you have written...

As it is a built in OS feature, it cannot be seen as a security problem, at most a confidentiality one if you do not want MS to know about any application that you could use on your system.