Check your Delphi’s installation – it may be infected

[Pyrogine]

The topic says it all, I just saw this post and my heart stop beating for a moment. He says d4-7 and I run d2009 but still. I checked just to make sure. This is nuts man.

http://blog.eurekalog.com/?p=244

and

http://jamiei.com/blog/2009/08/malwa...geting-delphi/

Sigh!

[AthenaOfDelphi]

Nice shout Jarrod.

Needless to say, I'm forwarding this to everyone I can think of that uses one of the affected versions.

[AthenaOfDelphi]

Something else to add... an idea thats been suggested by one of the guys here is to actually go through your installations and set SysConst.pas to be read-only and keep a backup copies of the SysConst (pas and dcu) files... just in case.

[noeska]

Is this the only possible files or need other files also be secured?
Also are delphi version above 7 affected or not?

[Wizard]

Checked SysConst.dcu in both Delphi versions 6 and 7 and the string “CreateFile(pchar(d+$bak$),0,0,0,3,0,0);” could not be found so I'm safe.

Hope so!!

Thanks for the headsUp!!!

[vgo]

Only the compiled sysconst.dcu is infected, the source code remains unchanged.

Delphi 2007 and 2009 aren't affected by this.

[AthenaOfDelphi]

Only the compiled sysconst.dcu is infected, the source code remains unchanged.

Delphi 2007 and 2009 aren't affected by this.

From one of the articles:-

For each founded instance of Delphi:

1. It makes a copy of SysConst.pas file and inject itself into it.
2. It compiles new SysConst.pas and places new infected dcu-file into Lib folder.

The source code is deleted after SysConst is recompiled meaning you can't recover it without extracting it from a backup or the original install files.

[paul_nicholls]

Checked SysConst.dcu in both Delphi versions 6 and 7 and the string “CreateFile(pchar(d+$bak$),0,0,0,3,0,0);” could not be found so I'm safe.

Hope so!!

Thanks for the headsUp!!!

Ditto for me too, so it appears I'm safe at work and home...phew!
cheers,
Paul

[Pyrogine]

I found this on the avast forum:

http://forum.avast.com/index.php?top...2787#msg402787

Sigh... i wonder how many Delphi apps made with those versions are infected and on our machines?

[arthurprs]

ps: i just checked, i'm not infected