Thanks to reviewer "Nocturnus" at FreewareFiles.com for reporting this virus and my apologies. However, do not panic or worry. Although the software he used BitDefender called Win32.Induc.A a virus, it is in fact not a virus. A virus by its nature will infect other files on your computer but this one will not. It is known as a False Virus and is a malicious modification to a Delphi programmming file called "SysConst.dcu" and its only purpose is to cause anti-virus programs to flag it as a virus and therefore stopping the program from running. It will not do anything else.
Delphi is the programming language I use for developing my software, but there are competitor programming languages that are not as good. It appears that someone created this "virus" malware in order to disrupt any program execution of exe files created by Delphi. The virus only affects a program that has been compiled by Delphi and it cannot spread beyond that particular file.
Tekline Universal Media Player 1.0.2 has been submitted and checked by 40 virus programs via VirusTotal. Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by 40 antivirus engines. The result was zero, no viruses of anykind was reported. A PDF of the report can be viewed here....
|
Only Tekline Universal Media Player 1.0.1 is infected by Win32.Induc.A. To check to see if you have this version click on the "?" button on the program. If it is do not worry it will not do any harm to your computer and all you need to do is to delete the file TIMVideo.exe found in your C:\TIMVideo folder and replace it with this one. That's it!
"The virus, called Win32.Induc.A, spreads by infecting systems that have the Delphi compiler (versions up to 7.0) installed. Any programs which are subsequently compiled using the compromised compiler contain the virus code. Although no payload is dropped or malicious action taken other than self-reproduction, the spreading of this virus to installer packages proves that this extremely unusual infection vector is, in fact, valid and relevant today, raising concerns that it will eventually be used to nefarious purposes."
-
BitDefender
"We recently added detection for a file infector to our databases, for something we call Virus.Win32.Induc.a. Since then, we've had a load of questions about it. It doesn't currently have a malicious payload, and it doesn't directly infect .exe files. Instead, it checks if Delphi is installed on the victim machine, looking for versions 4.0, 5.0, 6.0 and 7.0.
-
VirusList
"There is a new type of virus in the wild called Win32.Induc.A / Delphi.Induc since April 2009 that only infects Delphi Compilers. Unfortunately anti virus software started to detected it almost 4 months later. During that time the virus was spread wildly on the internet and on magazin CDs. And now a lot of applications are infected."
" The good thing about this virus is, that it only infects Delphi 4 - 7 and no other programs or executables.
The bad thing is, that most anti virus programs refuse to start applications that have been compiled with infected Delphi compilers. Most anti virus applications are also unable to remove that virus from the executable. So you end up with a lot of applications on your hard disk that you are unable to start."
-
GSA (Software development and Analytics) (contains freeware remover for this "virus" if you prefer not to download fixed TIMVideo.exe file described above.
Virus:Win32/Induc.A copies source\rtl\sys\SysConst.pas (Delphi library source file), in the found Delphi root directory to lib\SysConst.pas. Then it appends malicious source code to the copied file.
Virus:Win32/Induc.A renames the original Delphi library file lib\SysConst.dcu to lib\SysConst.bak and then invokes the Delphi compiler (bin\dcc32.exe) to compile a new copy of SysConst.dcu with the replaced copy (lib\sysConst.pas) of the source file. Finally, Virus:Win32/Induc.A deletes the file lib\SysConst.pas and sets the new compiled lib\Sysconst.dcu to the same date/time as the original copy.
After a computer is infected by Virus:Win32/Induc.A, ALL files compiled/linked by the Delphi compiler on that computer will be infected. What this means is any program that a Delphi programmer will develop, when it is compiled to produce the .exe program, that file will be infected.
Download and install Tekline Universal Media Player for FREE and virus checked.
Tekline Universal Media Player 1.0.2 TIMVideo.exe has been submitted and checked by 40 virus programs via VirusTotal. Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by 40 antivirus engines. The result was zero, no viruses of anykind was reported. A PDF of the report can be viewed here....
Download the latest TIMVideo.exe file 1.0.2 and replace your existing one.
I used this program (30 day trial) and it sorted out the problem that is described here very effectively. Even though it is a trial it is fully functional for 30 days. It will detect the virus and allow you to remove those files affected. I was very impressed! Then I replaced TIMVideo.exe 1.0.1 with the one above 1.0.2.
I found this program after I had sorted out the virus with the actions described above. So I have not tested it, but it claims to remove the virus. "GSA has developed a freeware tool that could remove the Win32/Induc.A virus completely from executables and let you start them again without your anti virus complaining about it."