Delphi Software houses may be infecting customers

interesting.. .we do all our development in delphi


i'd be keen to see what it injects into the source code. anyone have a sample?
 
Yeah, we use delphi as well.

found more info

When a file infected with W32/Induc-A runs, it looks to see if it can find a Delphi installation on the current machine. If it finds one, it tries to write malicious code to SysConst.pas, which it then compiles to SysConst.dcu (after saving the old copy of this file to SysConst.bak). The new infected SysConst.dcu file will then add W32/Induc-A code to every new Delphi file that gets compiled on the system.
Click to expand...

from http://www.scmagazineus.com/Virus-discovered-deep-in-Delphi-programming-language/article/146804/
 
Same here. Saw it first on Marco Cantu's blog.

Complete details on Eureukalogs's site: http://blog.eurekalog.com/?p=244 (Awesome tool for Delphi btw..)

Quote:

Is it serious?

Depends on what you’re asking about.

If you want to know about this particular virus, then the answer is: NO. This thing does nothing, except replicating itself.

If you ask about any threat of such sort, then the answer is probably: YES. Well, at least it’s so for Delphi’s developers. Look, that thing was here for few years and nobody didn’t notice it. It was detected only because it is buggy (see below). What if there are other such things lives on our Delphi’s out there? They may be not such innocent, as this one, and may be bug-less, so it’s harder to notice. Developers often tends to work in “weaker” environment: i.e. with UAC off, under administrator account, with disabled A/V, etc, etc. Those conditions are like heavens for viruses.
 
Last edited:
i found the source code.

it does nothing malicious except propogate the source code to overwrite and recompile sysconst.pas
 
This is a very old trojan - it only affects Delphi 7 and earlier - released 2002.
 
We also use Delphi.

Fired off the link (from The Register) to our lead developer.

Our code is clean, otherwise we would've got a lot of silly bugger errors :D
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X