So far only Delphi 4-7 are infected. But it's IMO just a question of time until we'll see version B with D2009 support. It is reported as Win.Induc or similar by some scanners. Look into the Delphi\lib folder, if there is a sysconst.bak your sysconst.dcu is most likely infected. To clean it just rename sysconst.bak back to sysconst.dcu. Currently the virus only creates the new sysconst.dcu if there's no .bak yet. Since usually there is no need to write to the Lib folder it's a good protection to not grant write permission to anybody to this directory.
-- Arno Garrels Dod wrote: > Hi, > > I suppose some of you have been informed about a virus spreading aver > Delphi 3-7 installed machines. > > I've been infected myself on my 3 Delphi 7 machines ! > > The virus itself is not dangerous (glad) and only spread if your > machine is installed with Delphi 3-7, then it change code of > sysconst.pas, rename old .dcu to .bak, recompile it, and put .pas back > to original, so once infected your Delphi machine each time you > compile a new EXE then virus is inside it and once executed on an > other machine it search for possible Delphi 3-7 installation to spread > using same scheme. > > Look like tons of Delphi apps you can download around Internet are > already infected, so the virus may exis for some months but has only > been discovered last week. > > Virus do not hurt anything on system, only try to spread on Delphi > installed machines but for now any up-to-date anti-virus with trigger > an alarm so your customers may be estonished. > > regards. -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
