FANDOM


W32.Induc.A is a computer virus on Microsoft Windows that infects Delphi files. It only infects Delphi versions 4, 5, 6, and 7. If Delphi isn't installed on the computer, the files remain dormant until installation of said product. It infects

all released Windows computers. It was discovered 18/8/09, and has since stemmed two other viruses in the family.

Description

Induc searches for "RootDir" value under the Registry key "HKLM\Software\Borland\Delphi\x.0\", where "x" is a value from 4 to 7. If it founds the main Delphi directory, it searches for "SysConst.pas" under the directory "source/rtl/sys", in the main Delphi directory, and make a copy of it in "sys/SysConst.pas". It appends malicious code to that file. It renames "lib/SysConst.dcu" to "lib/SysConst.bak" and uses DCC32 to compile "lib/SysConst.pas", creating a new "lib/SysConst.dcu" file. It deletes the file "lib/SysConst.pas". It restores file time and file date of "lib/SysConst.dcu".

Community content is available under CC-BY-SA unless otherwise noted.