Delphi7 compiler times WIN32.INDCU.A virus solution

Delphi7 used for a long time have no problem, the same project file was compiled yesterday mod32 not report poison, today recompile, generated EXE suddenly nod32 report poison. Tips:

"Variant of Project1.exe WIN32/INDUC.A virus removed-isolated NT Authority\System event occurred on the application new file: C:\Program files\delphi7se\bin\delphi32 . exe. "

　　

Check WIN32/INDUC.A:

August 20 update NOD32 official virus explanation

WIN32/INDUC.A
Aliases: virus.win32.induc.a (Kaspersky), w32/induc(McPhee), VIRUS:WIN32/INDUC.A (Microsoft )

virus type:Virus(virus)
size : about 5 KB

Impact Platform: Microsoft Windows operating system
can be Avira version:4346 (20090818)



Introduction
WIN32/INDUC.A is a virus that can infect Delphi files at compile time (compile-time ) .  

Seizures
The virus does not have any behavior to replicate itself.  

The virus is copied against the following files (source files, destination files):
l %delphi rootdir%\lib\sysconst.dcu, %delphi rootdir%\lib\sysconst.bak
l %delphi Rootdir%\source\rtl\sys\sysconst.pas,%delphi rootdir%\lib\sysconst.pas

The following files were modified:
l %delphi Rootdir%\lib\sysconst.pas

The virus writes its own source code to the file.  

the virus executes the following command line:
l "%delphi rootdir%\bin\dcc32.exe" "%delphi rootdir%\lib\ Sysconst.pas "

The final file "%delphi rootdir%\lib\sysconst.dcu" includes the original code.

The following files were deleted:
l %delphi Rootdir%\lib\sysconst.pas


file Infections
win32/induc.a is a virus that infects Delphi -compiled files.  
compiler programs written in Delphi language also carry virus code. The size of the insert code is 5KB.
Additional Information
Delphi versions 4,5,6,7 are affected.

　　

View Files ,

　　

Workaround :

If the Delphi installation directory LIB\SYSCONST.DCU is greater than/equal to 17K, it means that the SYSCONST.DCU normal size is about 12K, repair this file and then recompile the program will not have a problem ( found in lib\ Sysconst.bak a 11.7K, the SYSCONST.DCU 20K deleted. Change Sysconst.bak to SYSCONST.DCU all ok!)

Transfer from the network, if there is infringement, please inform, the first time to delete!

Delphi7 compiler times WIN32.INDCU.A virus solution