WIN32/inducA - with an APOLOGY by BINERUS ! « Giveaway of the Day Forums

Back to Giveaway of the Day

Giveaway of the Day Forums » General discussion

WIN32/inducA - with an APOLOGY by BINERUS !

(31 posts) (15 voices)

Started 14 years ago by YEPPERDEPPER
Latest reply from Robert

12 Next »

YEPPERDEPPER
Member

Avira found 11 instances of WIN32/inducA this morning

All programs were downloaded from GAOTD

The file 'C:\Program Files\3D Image Commander\imagecommander3D.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4aedf0a3.qua' ( QUARANTINE ).
The file was deleted!

Virus or unwanted program 'W32/Induc.A [virus]'
detected in file 'E:\Program Files\3D Image Commander\imagecommander3D.exe.
Action performed: Move file to quarantine

The file 'E:\Program Files\LinkCollector\LinkCollector.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4afb11e3.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\Program Files\Icon Commander\iconcommander.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4afc1000.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\Program Files\3D Image Commander\imagecommander3D.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4aee0b9d.qua' ( QUARANTINE ).
The file could not be deleted!
Attempting to perform action using the ARK library.
The file was deleted!

The file 'C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1241\A0457102.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '4ac0f709.qua' ( QUARANTINE ).
The file was deleted!

The file 'E:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1241\A0457105.exe'
contained a virus or unwanted program 'W32/Induc.A' [virus]
Action(s) taken:
A backup was created as '49ad9281.qua' ( QUARANTINE ).
The file was deleted!

etc, etc

Posted 14 years ago #
alhall
Member

Ditto here with Linkcollector. This appears to be a new type of virus that infects apps written in Delphi. Th3ere are many new posts about it via Google. Here's an overview:

Richard Cohen, one of the analysts at SophosLabs, blogged yesterday about a curious piece of malware designed to infect applications written using Delphi (a variant of the Pascal language originally developed by Borland, and now used to quickly develop Windows programs such as database applications).

The W32/Induc-A virus inserts itself into the source code of any Delphi program it finds on an infected computer, and then compiles itself into a finished executable.

Since yesterday, Sophos has received over 3000 unique infected samples of programs infected by W32/Induc-A from the wild.. This makes us believe that the malware has been active for some time, and that a number of software houses specialising in developing applications with Delphi must have been infected.

Examples of infections have included applications that submitters have described as:

* "A tool for downloading configuration files onto GSM modules"
* "A compiler interface that operates between our third-party design software and our CNC woodworking machinery"

Delphi code

In addition, and quite ironically, we have seen a number of banking Trojan horses (that are often written in Delphi) infected by Induc-A.

Could it be that the malware has also hit other malware authors?

Delphi is frequently used to create bespoke software, either by small software houses or by internal teams. If you believe that you may be using software written in Delphi you would be very wise to ensure that your anti-virus software is updated. Actually, regardless of whether you use Delphi-written apps that's a good idea.

And if you do find a W32/Induc-A infection in one of your programs, speak to its developers immediately - as it's quite possible they have also been passing an infection on to other customers.

Let me reiterate - this virus isn’t just a threat if you are a software developer who uses Delphi. It’s possible that you are running programs which are written in Delphi on your computers, and they could be affected.
Posted on August 19th, 2009 by Graham Cluley, Sophos

Posted 14 years ago #
watcher13
Member

That's great stuff, alhall. YepperDepper, probably unintentionally posted this thread twice. On the other one, I've reproduced Avira's official release on the subject, saying that ComputerBild magazine and the Chip website were giving away infected files:

http://www.giveawayoftheday.com/forums/topic/6008#post-62567

Maybe the moderators, when they see this, can consolidate the posts.

BTW,Graylox also said in the German forum she saw a low priority Kasperky hit on this. Nobody's said, yet, how much damage this could do, if much at all.

Posted 14 years ago #
pavid
gamer extraordinaire & knowledgeable computer nerd who likes to argue, but is still a very nice guy

I ran into the same problem when new virus definitions were installed on my computer on the 18th and a full system scan was performed. The vector on my machine was 3D Image Commander. My computer continues to run normally so I'm not going to panic although I feel that GOTD should address this quickly which I think everyone would appreciate.

Posted 14 years ago #
judydog
Member

Hi,this is strange because I have 3d image commander but avira says it is clean(fully updated) but I got the same warning for Icon commander.

Posted 14 years ago #
watcher13
Member

The problem, pavid, is whether the infection was in the files when you downloaded them or whether you picked it up from somewhere else - and it spread to anything on your computer written in Delphi. That's assuming, of course, these two are written in that language. No offense meant. Since this virus has just been identified, it may be a lot more prevalent than we know. I agree, however, that I hope GOTD sees this and retests those files. Maybe someone should send them an email on this, with a link to this thread. However, I don't even know if GOTD keeps these old programs on file or erases them after the giveaway. (?)

Posted 14 years ago #
Robert
StrayCat

I agree watcher.The supposed infected files most probably were not infected when they were downloaded from GOTD.
I 'd suggest getting a second opinion though and upload the quarantined files to http://www.virustotal.com (and to your antivirus company) for analysis to make sure.

And some antivirus programs produce a lot of false positives if their definition files are updated incorrectly or their heuristics are too strict.
I even dumped an antivirus in the past because even when submitting a 'clean' file for analysis, the company didn't bother to update their definitions files within a reasonable period.

Posted 14 years ago #
watcher13
Member

Yeah, Robert, it's accepted by many that Avira has the most aggressive heuristics of the major AVs, although I still think it's worth the trouble.

MORE IMPORTANTLY, it looks like WIN32/Induc is currently harmless. It looks like it was a hacker test just to prove it could be done, because no one has described this as doing any damage. Of course, they may try to do something with it later, but now the programming and AV and security communities are alerted and mobilized.

Posted 14 years ago #
Terri218
Member

I got it also and I never downloaded anything from GOTD but it said it was in Game Booster which I'm pretty sure I found from a recommendation here. I took Game Booster off my computer. Was I being too cautious?

Posted 14 years ago #
judydog
Member

Hi,I have game booster and mine is showing up clean,I download a lot of programs from gaotd and the only one that had this virus? was Icon commander.

Posted 14 years ago #
ramfisher65
Member

i also have this ,but I i have never downloaded fron GOTD, but I have game booster from IObit and keeps showing up. my next move?

Posted 14 years ago #
caulbox
Member

Another ditto with Icon Commander, which does suggest that at least this one executable might have already been infected when downloaded from GOTD? Again, after a recent definition update, ZoneAlarm interrupted me a couple of days ago with the warning about the file. On this occasion I was able to (manually) repair the file successfully with ZA (usually I need to delete a virus). I hadn't used Icon Commander for a long time, and I immediately followed the disinfection with a thorough scan of my system and program partitions. Fortunately, no further infections were found, though I do use a Delphi program very frequently (Empty Temp Folders which uses Borland Delphi 4).

Posted 14 years ago #
infotech
Member

Hi - AVG has just reported the virus in Image Commander - it sent the virus to the vault and I have uninstalled it. I am not an expert on virus removal. Is there anything else I should be doing? Many thanks.

Posted 14 years ago #
triphammer
Member

I have AVG and when I turned on my computer this morning it's showing WIN32/inducA as a virus present in 3d Image commander and Icon commander.

Posted 14 years ago #
judydog
Member

Hi,I also have 3d image commander downloaded from gaotd but I have scanned it to death with avira premium,mawarebytes,advanced system protector and iobit 360 all come back clean and all are fully updated with the latest defs.

Posted 14 years ago #
MrFishy
Member

Infotech . . . I think you also need to dump old restore points and create a clean one, or the issue may be restored on your next re-boot? Probably want to run an additional full scan prior to setting new restore point.
I'm no tech, so confirm this "thought".

Posted 14 years ago #
watcher13
Member

The best advice I can give you is: "Don't Panic". I can't advise you not to be cautious. You might want to bite the bullet and remove any infected software, but you're not under any current threat. This article from Kasperky's website is the best explanation I've seen, yet:

"Kaspersky Lab, a leading developer of secure content management systems, reports detection of Virus.Win32.Induc.a, a virus that spreads via CodeGear Delphi, an integrated software development environment. Protection from the latest threat is already available in all Kaspersky Lab products. Virus.Win32.Induc.a takes advantage of the two-step mechanism used in the Delphi environment to create executable files. The source code is first compiled to produce intermediate .dcu (Delphi compiled unit) files, which are then linked to create Windows executables.

The new virus activates when an infected application is launched. It then checks whether Delphi development environment versions 4.0, 5.0, 6.0 or 7.0 are installed on the computer. If the software is detected, Virus.Win32.Induc.a compiles the Delphi source file Sysconst.pas, producing a modified version of the compiled file Sysconst.dcu.

Practically all Delphi projects include the string “use SysConst”, which means the infection of only one system module results in the infection of all applications under development. In other words, the modified SysConst.dcu file causes all subsequent programs created in the infected environment to contain the code of the new virus. The modified .pas file is no longer required and is deleted.

The virus is not currently a threat – there is no destructive behavior apart from infection. (emphasis added by me)

It is most probably intended for demonstration and testing of a new infection routine. The absence of a destructive payload, the infection of several versions of the popular instant messaging client QIP and the usual practice of publishing .dcu files by developers has already led to Virus.Win32.Induc.a becoming widespread throughout the world. It is very likely that in future it will be picked up and tweaked by cybercriminals to make it more destructive. Kaspersky Lab solutions successfully detect Virus.Win32.Induc.a and treat both compiled Delphi files and Windows executables."

The best advice may be to report any infected program you find to the developer, who will go to work to insulate it from this vulnerability. In the case of the GOTDs, the developers may issue passes or you'll at least have a shot at a safer version if the giveaway is repeated. The CodeGear people - Embarcadero Technologies haven't said anything yet, but they could be working on a patch, so you might want to risk it and hold on to these programs. But you're in no immediate danger.

Posted 14 years ago #
caulbox
Member

OK - I use a separate partition for storing the stuff I've downloaded (until burnt). I've just scanned my GOTD downloads with ZoneAlarm AntiVirus, and I can confirm that the Win32.Induc.a virus was indeed found in the GOTD "setup.exe" files for both "Icon Commander 1.10" and "3D Image Commander" (I didn't install 3D Image Commander on my system - but I still had an unzipped copy of the original GOTD archive). I didn't download "LinkCollector" so can't comment about that one. However the GOTD download folder which I've just scanned did include a total of 91 other recent GOTDs, and 'only' these two files were found to be infected.

Virus.Win32.Induc.a was found in I:\Utils 14\! GOTD !\Utilities\3D Image Commander\Setup.exe on 21/08/2009 18:02:50
Virus.Win32.Induc.a was found in I:\Utils 14\! GOTD !\Utilities\Icon Commander 1.10\Setup.exe on 21/08/2009 18:25:28

Unlike before when I was successfully able to repair my installed Icon Commander executable (iconcommander.exe) it was not possible to disinfect the virus in the setup.exe files with ZA. I opted instead to instruct ZA to delete the infected files completely. I'll most likely get around to scanning my burnt GOTD DVDs (where I also keep archives) in the next day or two. I'll report back again here if any further infections are found in older archives.

Posted 14 years ago #
watcher13
Member

I hope I'm being clear about this. It infected the softwares listed here because they were written in Delphi, and maybe only the CodeGear brand version. Nothing not written in that language can be infected by this.

Posted 14 years ago #
pavid
gamer extraordinaire & knowledgeable computer nerd who likes to argue, but is still a very nice guy

I agree with you Watcher. If it's anybody's fault, it's that of whomever was able to introduce the virus into Delphi. GOTD is not at fault for this problem. Additionally, nothing I've read suggests this "virus" actually does anything. I didn't use 3D Image Commander right after I installed it and I saw no warnings from my security package that it had attempted to phone home. Additionally this virus never spread beyond 3D Image Commander except for the EXPECTED inclusion in System Volume Information files.

My take on it is that someone introduced the virus into Delphi just to see how far it would be distributed.

Posted 14 years ago #
watcher13
Member

Yeah, that's pretty much the way I understand it, pavid, and folks should note that sentence in the Kasperky article: "the infection of several versions of the popular instant messaging client QIP". I wonder how many around the world got the infection from that? In other words, it's still too early to identify the major culprits in spreading this infection. It's even still up in the air as to whether everyone who downloaded 3D Image Commander and Link Collecter actually got infected.

Posted 14 years ago #
caulbox
Member

The virus and an explanation for its non-detection is succinctly summed up in this avast! blog:
http://blog.avast.com/2009/08/19/win32induc-new-concept-of-file-infector/

It could even prove fortunate that this (new?) malicious behaviour has opened the eyes of hitherto blind AV companies. Although the virus appears to be benign on this occasion.....

"More of a worry is when the ‘developers’ of this virus take it to the next level and add a malicious ‘payload’ to the virus… "

Let's hope any similar 'families' of dreads will be nipped in the bud in the future.

Posted 14 years ago #
pavid
gamer extraordinaire & knowledgeable computer nerd who likes to argue, but is still a very nice guy

Thanks for the link caulbox. It is informative and helpful.

Posted 14 years ago #
infotech
Member

Watcher13 - I would like to thank you for your post. I greatly appreciated your response. I deleted/uninstalled 3D Icon Commander and 3 other applications that were infected running AVG. I then ran a full scan again and it came back without errors. I shut down the computer and have now running an AVG scan again.

MrFishy - I haven't touched the restore points as I am not certain this is necessary. Perhaps Watcher13 or other experts could comment. Thank you anyway.

Regards

Posted 14 years ago #
watcher13
Member

Your welcome, infotech, actually a lot of good people posted useful stuff on this - which is not a criticism of you, I know you'll agree - I just didn't want to hog the limelight.

Actually, I think Mr. Fishy makes a good point. It trips some people up on occasion. Another way to explain it is: if none of your previous automatic restore points were from before the time you got the infection - and there may be no way to insure when that was - then you might end up restoring some or all of the infection if you have to use a restore point to fix anything in the near future. So he's just saying to make sure you have a restore point from after you've done the cleaning. If your system hasn't already made an automatic one, go ahead and create a manual one. To me it's sound advice, and that way you have a good restore point if you need it. Actually, it's a good idea after most, if not all, repairs. And it really can't cause you any damage.

Posted 14 years ago #
FlashRiver
Member

Bravo to all who have commented on the W32/Induc-A virus issue. I have to give it to the developer of the virus. If it was a hackers test as “Watcher” suggest, it has passed with flying colors. It seems it very well may-haps been a timed activated little jewel indeed. It seems unlikely that of all the different types of antivirus programs we all are using that all of them had an out-of-date virus definition. I can however honestly say, I would gladly pay the makers of the virus twice what I would pay for either 3D Image Commander or Icon Commander after seeing its potential for mass confusion LOL
thanks guys for your input...
~ Flash

Posted 14 years ago #
watcher13
Member

Well, Flash, it's not that it was out of date, it's that it's brand new. You may have heard that many hackers are what are called "white" hackers. They develop these programs without a payload so they can get their jollies by just demonstrating the vulnerabilities. Though many wouldn't agree, they feel they're doing a good thing. (And they get to practice there favorite hobby at the same time.) I suspect that's what happened here.

And, one of the principal reasons people turn to "white" hacking is that white hackers usually don't get prosecuted! And to be fair, sometimes these people point out security holes to the companies involved first, and the companies try to just bury it. Sometimes white hackers hack out of frustration. I hear this has happened to Microsoft more than once.

Posted 14 years ago #
caulbox
Member

Just to add a bit more reassurance for GOTD users. I've now scanned more than 2GB of older GOTD downloads which I'd burnt to DVD, and no other occurrences of the Win32.Induc.a virus were found.

That said, I probably download more utilities than most, and I wouldn't be surprised if I encounter a few more occurrences of this virus later (in files downloaded from various sources on the net). I'll probably not bother to painstakingly scan all my DVDs, as I trust the "On-Access Scanning" behaviour in ZoneAlarm AntiVirus - and now that ZA has been made aware of this virus definition, as soon as I open a directory with an infected file ZA will immediately warn me.

infotech - I don't have any experience with AVG (which may or may not be so reliable?), but I can tell you that scanning a partition with ZoneAlarm Antivirus will also find any copies of a virus which might have been 'backed up' in system restore points. I use (a lot) more partitions than most, but choose to monitor only my main system partition C: with system restore. That explains why no further presence of this virus was found (in system restore related files) after my earlier thorough scans of my system and program partitions - the original virus was located in my programs partition, not my system partition. Had I opted to enable system restore on my programs partition as well, then most likely (as with the OP here) ZoneAlarm AntiVirus would also have detected further copies of the virus in the system restore files for that partition. Hope that makes things a bit clearer?

Posted 14 years ago #
eugenekryukov
Member

Dear Sirs,

I'm really sorry for the inconvenience.

This virus is not dangerous.
Please read more detail descriptions here -
http://www.viruslist.com/en/weblog?weblogid=208187826
http://www.delphipraxis.net/topic163041_virus+infects+delphi.html

Please uninstall your current version and setup new one.

All clean versions you can download from http://www.binerus.com

Eugene Kryukov
Binerus

Posted 14 years ago #
notblocklox
retired

Hi and welcome to Eugene Kryukov,Binerus !
Let me send a "Thank's" to you !
Though this virus infection wasn't your mistake you come to us and apologise, not many developers found the way to our forums.
Welcome back and I would be glad if you would give your programmes again to the GOTD project. wink-wink
Thank you!

graylox

Posted 14 years ago #

RSS feed for this topic

12 Next »

Reply »

You must log in to post.