So far only Delphi 4-7 are infected.    
But it's IMO just a question of time until we'll see version B
with D2009 support. 
It is reported as Win.Induc or similar by some scanners.
Look into the Delphi\lib folder, if there is a sysconst.bak  
your sysconst.dcu is most likely infected. To clean it just 
rename sysconst.bak back to sysconst.dcu. Currently the virus
only creates the new sysconst.dcu if there's no .bak yet.
Since usually there is no need to write to the Lib folder
it's a good protection to not grant write permission to anybody
to this directory.  

Arno Garrels

Dod wrote:
> Hi,
> I  suppose some of you have been informed about a virus spreading aver
> Delphi 3-7 installed machines.
> I've been infected myself on my 3 Delphi 7 machines !
> The  virus  itself  is  not  dangerous  (glad) and only spread if your
> machine  is  installed  with  Delphi  3-7,  then  it  change  code  of
> sysconst.pas, rename old .dcu to .bak, recompile it, and put .pas back
> to  original,  so  once  infected  your  Delphi  machine each time you
> compile  a  new  EXE  then  virus is inside it and once executed on an
> other machine it search for possible Delphi 3-7 installation to spread
> using same scheme.
> Look  like  tons  of  Delphi apps you can download around Internet are
> already  infected,  so the virus may exis for some months but has only
> been discovered last week.
> Virus  do  not  hurt  anything on system, only try to spread on Delphi
> installed  machines but for now any up-to-date anti-virus with trigger
> an alarm so your customers may be estonished.
> regards.
To unsubscribe or change your settings for TWSocket mailing list
please goto
Visit our website at

Reply via email to