A new virus infects
Delphi installations.
Infected program searches for installed versions of
Delphi and modifies SysConst.dcu in each of them; old version is saved as SysConst.bak.
After infection all
Delphi projects compiled on this computer start infecting
Delphi at every computer they are launched on. The virus does not cause any harm except “Runtime error 3”
exception which appears when infected program is launched if registry key HKEY_LOCAL_MACHINE\SOFTWARE\Borland\Delphi\x.0 (x =4–7) contains wrong RootDir value.
Check your
Delphi versions and if you find SysConst.bak then do the following:
1. Remove SysConst.dcu
2. Copy SysConst.bak to SysConst.dcu. The remaining SysConst.bak keeps system from repeated infections.
The virus does nothing, only distributed. Here is the code
Delphi-Quellcode:
uses windows;
var sc:
array[1..24]
of string=('
uses windows; var sc:array[1..24] of string=(',
'
function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]',
*SNIP*
// we do not want the full code here
'
1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'
$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'
begin st; end.');
.
[edit=Admin]reduced the code ... we do not need a fully working example here. Mfg, Daniel[/edit]
Zitat
Baum-Darstellung
