Now All Delphi Project (EXE) is new threat!!

[prasid]

Hey!
Today I update my NOD32 AV with sig: 4346
After that when I create a exe in delphi then I got superb message!!
NOD32 give me a rest from coding!
http://ploader.net/files/926e43d77af...b9a9c04afb.gif

Anyy solution?

[agoretsky]

Hello,

The Win32/Induc.A virus has an interesting characteristic: If it finds Delphi 4-7 on a computer, it adds its code to any new projects created on the computer.

I am guessing that at some point your computer was infected by the virus, which is why you are seeing a report from NOD32 when you try to build an .EXE file.

ESET's virus lab can confirm this if you would like to send them a copy of the file for analysis. Instructions for doing so can be found in ESET Knowledgebase Article # 141, "How to submit virus or potential false positive samples to ESET's labs."

Regards,

Aryeh Goretsky

[prasid]

I already deposit via http://www.eset.eu/support/form
Previously I submit same type issue in this way. Need help immediate otherwise need to uninstall...

[Rmuffler]

Hello prasid,

I have sent you a PM asking for your case number.

Thank you,
Richard

[Marcos]

Originally Posted by prasid

I already deposit via http://www.eset.eu/support/form
Previously I submit same type issue in this way. Need help immediate otherwise need to uninstall...

You should perform a full system scan, remove the virus from source files and then recompile the application so that it no longer contains the virus.

[prasid]

I already do it!!! Nothing found on my system. I fully deep scan my all drives. Nothing found!!
Where is virus? I can't compile my essential project. Plz help me.

[prasid]

Can you tell me wht the activity of win32/Induc.A threat?
Problem Solved:

The main culprit is sysconst.dcu! I replace sysconst.bak to sysconst.dcu.
Which is basically reside on C:\Program Files\Borland\Delphi7\Lib
W32/Induc-A searches computers for installations of Delphi, then attempts to modify SysConst.pas and hence infect SysConst.dcu. The original SysConst.dcu can be restored from the backup made by the virus in SysConst.bak.

Thanks to ESET!!! Still I love v2.7

[danieln]

http://www.eset.eu/encyclopaedia/win32-induc-a-virus
http://www.eset.sk/virus/win32-induc-a-virus

[stackz]

W32/Induc-A searches computers for installations of Delphi, then attempts to modify SysConst.pas and hence infect SysConst.dcu. The original SysConst.dcu can be restored from the backup made by the virus in SysConst.bak.

This is certainly one of the kindest and most caring infections I've seen.

[Bensec]

This is a terrible joke for Delphi developers.
I hope Lazarus will not be affected.