Robert Poston over in the Vancouver branch of SophosLabs has posted an recently reported W32/Induc-A virus.
As Robert explains, in all cases Sophos’s detections were shown to be legitimate and the files were infected. Indeed, it seems that it is very unlikely that we will ever see a false positive from Sophos regarding this unusual Delphi code virus – so if we say a file is infected, it is!
It’s possible that some of the disbelief may have come about because users have misunderstood media reporting of the virus, and believe that only Delphi software houses can contract the malware.
However, if you’re a regular run-of-the-mill user you can still download or install code which a Delphi programmer doesn’t realise was tainted by W32/Induc-A. Furthermore, you might pass the malware on to other computer users who may have Delphi installations on their computer. So it would be wise for everyone to ensure that they have proper protection in place.
And if you do find an infection, tell the vendor or internal department who produced the software – so they can clean up their systems.
Meanwhile, if you’re a Delphi developer, and you believe you may have been infected by this virus, please send us samples of your SysConst.dcu, SysConst.bak and SysConst.pas files. We are especially interested if you have customized versions of these units.
There is more good advice in Robert’s blog entry.