YEPPERDEPPER, this is a brand new virus identified by Avira. It's a brand new definition, so there may be some kinks in it. In other words, there may be false hits. They may need to fine tune their detection routine on this one.

Here's what they posted on it all ready:

"Security News
Unusual virus on current free gift CDs
Tue, 18 August 2009
Harmful files are currently being encountered on free gift CDs issued with popular computer magazines and in download portals. These files infect the source code of development environments.

Tettnang, 18 August 2009 – An unusual virus has been encountered recently, for example on the free gift CD/ DVD issued with the 18/2009 edition of popular computer magazine ComputerBild and in the Chip download portal. The virus infects the source code of Delphi programming environments, so that programs produced using the environment will also infect the programming environments on other computers.

The harmful program changes the “SysConst.pas” file, uses it to compile the “SysConst.dcu” library, having first made a copy of the original named “SysConst.bak”. The copy enables the virus to check that its attack has been successful, preventing another infection. It then deletes the modified “SysConst.pas” file. Programmers should also be suspicious if programs crash with the error message “RunTime Error 3”.

The files identified so far that infect the programming environment are “TidyFavorites_Setup_4_1_free.exe” and “anytv241_setup.exe”. Users should not run these files under any circumstances. The file has been removed from the Chip download portal in the meantime.

Users should also update their anti-virus software – Avira’s security solutions identify the harmful virus as W32/Induc.A with VDF file 7.1.5.130."

Have you downloaded anything from the Chip site, or installed anything from ComputerBild magazine in the last couple days? If not, maybe they're false hits.

Moderators, this thread may need to be moved to GOTD virus reports, but, more importantly, you might want to instead consider a title change to this thead to alert folks that's there's a wild virus out there they may need to know about and which may or may not plague GOTDs written in Delphi. Again, these could be false hits. Just a suggestion of course.

Also, you'll notice that YEPPERDEPPER posted this twice. Don't know why. I don't think it's a hoax post, since there's a legit. virus out there. Probably just a glitch when posting.

*edit by moderator: please reply to this topic here*

Avira found 11 instances of WIN32/inducA this morning

All programs were downloaded from GAOTD

The file 'C:\Program Files\3D Image Commander\imagecommander3D.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4aedf0a3.qua' ( QUARANTINE ).
The file was deleted!

Virus or unwanted program 'W32/Induc.A [virus]'
detected in file 'E:\Program Files\3D Image Commander\imagecommander3D.exe.
Action performed: Move file to quarantine

The file 'E:\Program Files\LinkCollector\LinkCollector.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4afb11e3.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\Program Files\Icon Commander\iconcommander.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4afc1000.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\Program Files\3D Image Commander\imagecommander3D.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4aee0b9d.qua' ( QUARANTINE ).
The file could not be deleted!
Attempting to perform action using the ARK library.
The file was deleted!

The file 'C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1241\A0457102.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4ac0f709.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1241\A0457105.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '49ad9281.qua' ( QUARANTINE ).
The file was deleted!

etc, etc