Win32/Induc [Threat Name] go to Threat

Win32/Induc.A [Threat Variant Name]

Category virus
Detection created Aug 18, 2009
Signature database version 7470
Aliases Virus.Win32.Induc.a (Kaspersky)
  W32/Induc (McAfee)
  Virus:Win32/Induc.A (Microsoft)
Short description

Win32/Induc.A is a virus which infects Delphi files at compile-time.

Installation

The virus does not create any copies of itself.


The virus creates copies of the following files (source, destination):

  • %delphi rootdir%\­Lib\­SysConst.dcu, %delphi rootdir%\­Lib\­SysConst.bak
  • %delphi rootdir%\­source\­rtl\­sys\­SysConst.pas, %delphi rootdir%\­Lib\­SysConst.pas

The virus modifies the following file:

  • %delphi rootdir%\­Lib\­SysConst.pas

The virus writes its own source code into the file.


The virus executes the following command:

  • "%delphi rootdir%\­Bin\­dcc32.exe" "%delphi rootdir%\­Lib\­SysConst.pas"

The resulting file "%delphi rootdir%\Lib\SysConst.dcu" contains the original source code along with the source code of the infiltration.


The following files are deleted:

  • %delphi rootdir%\­Lib\­SysConst.pas
File infection

Win32/Induc.A is a virus which infects Delphi files at compile-time.


A compiled program written in the Delphi programming language will also contain the program code of the infiltration.


The size of the inserted code is 5 KB .

Other information

Versions 4, 5, 6, 7 of the Delphi development environment are affected.

Please enable Javascript to ensure correct displaying of this content and refresh this page.