| Aliases: | Virus.Win32.Induc.a (Kaspersky), W32/Induc (McAfee), Virus:Win32/Induc.A (Microsoft) |
| Type of infiltration: | Virus |
| Size: | Approximately 5 KB |
| Affected platforms: | Microsoft Windows |
| Signature database version: | 4346 (20090818) |
|
Short description
Win32/Induc.A is a virus which infects Delphi files at compile-time.
Installation
The virus does not create any copies of itself.
The virus creates copies of the following files (source, destination):
- %delphi rootdir%\Lib\SysConst.dcu, %delphi rootdir%\Lib\
SysConst.bak
- %delphi rootdir%\source\rtl\sys\SysConst.pas, %delphi
rootdir%\Lib\SysConst.pas
The following file is modified:
- %delphi rootdir%\Lib\SysConst.pas
The virus writes its own source code into the file.
The virus executes the following command:
- "%delphi rootdir%\Bin\dcc32.exe" "%delphi rootdir%\Lib\
SysConst.pas"
The resulting file "%delphi rootdir%\Lib\SysConst.dcu" contains the original source code along with the source code of the infiltration.
The following files are deleted:
- %delphi rootdir%\Lib\SysConst.pas
File infection
Win32/Induc.A is a virus which infects Delphi files at compile-time.
A compiled program written in the Delphi programming language will also contain the program code of the infiltration. The size of the inserted code is 5 KB .
Other information
Versions 4, 5, 6, 7 of the Delphi development environment are affected.
