The Problem:

I have an application that consistently attempts to access the network, probably a "phone home" atempt.
The firewall detects it and blocks it, but I would like to locate the code that does it and deactivate it. I have looked for a reference of network related API functions, but the list is rather daunting, and I have no clear idea of which API the application may be using, because I do not know anything about network programming.

I searched the app import list, and found nothing revealing, but this is one of those apps that is split in a zillion dlls over several folders, so it is not trivial to examine each one of them for net related APIs.

My question is, is there a low level function/code/port that is always invoked during network access that I can use as a bait to locate the offending code, and the offending dll?

Is there another approach to this problem?
The program is written in Visual C++ 6.0

Sorry for the newbie level question,

I guess it might work to run the application under an API monitor program (e.g. Autodebug), and then when the firewall warning comes up, just switch to the API monitor log and see what the last called API is in the application. Since the firewall blocks inside this API it should be the one (or at least among the few last ones, depending on what strange things the firewall might be up to). In that case you should be able to see directly where it is called from and everything.

Thank you Delta, that should do it.

Also, if the application is not supposed to do any network communication at all, an easy and efficient patch might be to simply make it believe that the call to WSAStartup (or similar network code init function) returned an error code.

To naides:

Another way to do it is like this:
1. Remove all rules for the program in the firewall.
2. Run the program in a debugger of your choice.
3. When the app. is trying to connect to the internet, the firewall
pops up asking if it should allow the program to connect.
4. Switch to the debugger, pause the program and examine the
code.