Win32/Induc [Threat Name] go to Threat
Win32/Induc.A [Threat Variant Name]
| Category | virus |
| Signature database version | 4346 (Aug 18, 2009) |
| Aliases | Virus.Win32.Induc.a (Kaspersky) |
| W32/Induc (McAfee) | |
| Virus:Win32/Induc.A (Microsoft) |
Short description
Win32/Induc.A is a virus which infects Delphi files at compile-time.
Installation
The virus does not create any copies of itself.
The virus creates copies of the following files (source, destination):
- %delphi rootdir%\Lib\SysConst.dcu, %delphi rootdir%\Lib\SysConst.bak
- %delphi rootdir%\source\rtl\sys\SysConst.pas, %delphi rootdir%\Lib\SysConst.pas
The virus modifies the following file:
- %delphi rootdir%\Lib\SysConst.pas
The virus writes its own source code into the file.
The virus executes the following command:
- "%delphi rootdir%\Bin\dcc32.exe" "%delphi rootdir%\Lib\SysConst.pas"
The resulting file "%delphi rootdir%\Lib\SysConst.dcu" contains the original source code along with the source code of the infiltration.
The following files are deleted:
- %delphi rootdir%\Lib\SysConst.pas
File infection
Win32/Induc.A is a virus which infects Delphi files at compile-time.
A compiled program written in the Delphi programming language will also contain the program code of the infiltration.
The size of the inserted code is 5 KB .
Other information
Versions 4, 5, 6, 7 of the Delphi development environment are affected.