Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

New virus spreads by attacking Borland compiler

Adds itself to Delphi code. Woops.

Article comments

An imaginative new virus that infects programs as they are being compiled has claimed its first scalps, infecting software sent out on a cover CD by a major German computer magazine and even other malware programs.

The 18/2009 edition of Computer Bild reportedly distributed the Win32.Induc virus inside an obscure browser aids called TidyFavorites 4.1 to its four million readership. The software is also believed to have infected a second program, Any TV Free 2.41, and Sophos reports with some irony of having discovered it inside several unnamed bank-hacking Trojans.

How it got into the programs is the interesting part of the story. According to a range of security companies that have been warning of the virus in the last week, Win32.Induc targets the Pascal-based Borland Delphi development tool, inserting its executable into any software compiled by the program.

Anyone running an application infected with the parasitic malware will become a new host for its further spread, assuming they too use the Delphi compiler, which makes it perhaps the first virus to successfully attack only one type of professional user.

Fortunately, the virus doesn't do anything, but could still cause a certain amount of havoc if apparently legitimate programs are quarantined by unhappy anti-virus software, experts have said.

"This is a real challenge for anti-virus vendors and those on the receiving end. When AV scanners start identifying applications as infected with Win32.Induc, it's an open question whether or not the scanners can clean them," said Michael St. Neitzel, VP of threat Research and technologies at security vendor, Sunbelt Software.

"If they can't, the original developers are going to be required to get the infection out of their Delphi compilers, recompile the applications and get the clean code back to their customers. Given there could be different versions of the infected applications in circulation, this is going to be a real nightmare for some companies to deal with," he said.

As novel as the virus sounds, according to Graham Cluley of Sophos, the outline of the technique has been tried at least once before, albeit with far less success. Three years ago, the company discovered a virus, dubbed Win32.Gattman, which attacked the Interactive Disassembler Pro (IDA) analysis tool used by malware researchers, probably as a grudge act against the anti-malware community.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *