A new worm, recently named W32.induce, operates in a slightly different fashion to existing worms. It targets software developers who use the Delphi compiler, and then inserts itself into all programs compiled using it. So far,no malicious payload has been observed; the worm only propagates itself through compiled code. Detecting and cleaning up the worm is also surprisingly simple: it actually backs up files before infecting them, so users only have to check for a file called SysConst. Back in their Lib folder. If it exists, simply rename the file to SysConst.DCU to overwrite the infected DCU file. In a funny twist, according to the Internet Storm Center, a number of Trojans have been found in the past few weeks which are themselves infected with the Indue trojan, indicating they were compiled on compromised systems. However developers are advised to recompile clean versions of all their software just in case they have inadvertently distributed the worm to their customers. A report by Sop hos highlights the danger of Indue because customers who see their trusted and familiar software has been infected are unlikely to believe anti virus pop ups, unlike garbled names or those promising pornography and gambling



Reply With Quote
Copyright Techfuels
Bookmarks