Researchers said on Tuesday they are seeing something unusual in the malware world -- a virus that targets a development environment.
The virus, dubbed Win32.Induc, was written to infect applications built with Delphi, according to Nick Bilogorskiy, manager of antivirus researcher at SonicWall. Delphi is used to write Windows programs, including database applications.
When an infected program is run on a machine running Delphi, the virus infects any software that gets compiled on that machine. The virus spreads the executable file of itself as well as the source code. It looks for a compiler on the infected system and recompiles the source code, inserting its code into any programs compiled on the system.
"This malware just spreads; it doesn't delete files or do anything malicious," he said. "But if you create software and you have this code in it, the software will be blocked by antivirus [technology]."
Developers whose systems are infected will pass the infection on to the programs they are creating, Bilogorskiy said.
Already, two free tools that are included in certain magazine CDs and are among the top 100 downloads on some portals -- Any TV Free 2.41 and Tidy Favorites 4.1 -- have been infected, he said. "As many as 30 per cent of developers who use Delphi have this," he added.
SonicWall and a number of antivirus vendors have updated their software to block the virus.
Sophos has more details on its SophosLabs blog.
1
JoeMomma - 21/08/09
I bet the virus was also written in Delphi - that way it doesn't need 200MB of .NET frameworks. :)
» Report offensive content
2
LOL@Delphi - 21/08/09
So, 2 applications have been found containing the virus, and 30% of Delphi devs have this, so that would mean, what, one other person out there has it right? LOL, that's like writing a virus for the Timex Sinclair 1000!
» Report offensive content