Virus in several FSPro Labs programs

FSPro Labs, 20-Aug-2009
Last update: 22-Aug-2009

Recently a new virus was found in our several programs.

Virus name: Induc

This is an absolute new kind of viruses and affects only computers of software developers.

Affected programs:

1. My Lockbox 1.4.1.79 - Update 21-Aug-2009: fixed in 1.4.4.85 - download now!

2. Hide Folders 2009 3.2.15.583 - Update 21-Aug-2009: fixed in 3.2.16.583 - download now!

3. Lock My PC 4.8.1.795 - Update 20-Aug-2009: fixed in 4.8.1.797 - download now!

4. Event Log Explorer 3.1.3.609 - Update 20-Aug-2009: fixed in 3.1.3.615 - download now!

According to viruslist.com (Kaspersky Lab), this virus doesn't have a malicious payload and it doesn't directly infect .exe files. Instead, it checks if Delphi is installed on the victim machine, looking for versions 4.0, 5.0, 6.0 and 7.0 and changes one of its files.

According to McAffee this virus has been in wild (undetected) for at least a year. During this period it has succeeded in infecting a lot of Delphi installations, including manufacturers of some pretty popular software packages (e.g. QIP instant messenger).

Resolution

If Delphi is installed on your machine, please copy Lib\sysconst.bak to Lib\sysconst.dcu.

To completely remove the virus, simply update the infected software.

You can install a new version over the old one. Some antiviruses may block the infected file even from being removed. In such a case, temporary disable antivirus protection, update the software, then enable protection again.

Our expectations

Since this virus has been undetectable at least for one year, we expect that the viruses that attacking developer machines will appear in furture and probably will have a malicious payload. We are taking actions to prevent possibility of infecting by all known and unknown viruses.

We are really sorry for this inconvinience.