W32.INDUC.A Successful correction - How To fix link

[eitang]

Unbelievable as it may sound, Symantec NEVER succeded to discover, let alone repair, my corrupted Delphi 5 unit !!!

So no multiple scanning or cleaning worked, as I described elsewhere here. After each pass I recompiled and the problem, remained in the compiled EXE.

I finally succeeded in definitively correcting this annoying problem in 5 seconds.

I then recompiled all my D5 programms written after JUNE 15th !!! (About 10 of them).

All are now clean, and those on my site are updated.

If you want to see how, the solution is described on my home page (and will remain there for a couple of days). [URL is below]

Incredible !!!

[ghisler(Author)]

Thanks for fixing your plugins/tools. Please check if you have any on www.totalcmd.net and/or totalcmd.pl, and if yes, replace them with the fixed ones.

[Lefteous]

The big problem is that plugin distribution cannot be controlled. Old versions are floating everywhere. An additional problem is that some makers of "special distributions" create a new setup once and never update it.

[ghisler(Author)]

Well, the same is true for any other freeware or shareware programs - but virus scanners will detect both programs and plugins, so there is no big difference. To the contrary, freeware programs are usually found on many more download sites than TC plugins...

[eitang]

Christian,

>> scanners will detect both programs and plugins,

But not the 17.5K (instead of 7.5k) SysConst.DCU <VVBG>

[karlchen]

Hello, Eitan.

>> scanners will detect both programs and plugins,
But not the 17.5K (instead of 7.5k) SysConst.DCU <VVBG>

Right. There are a few hints that a few AV producers have implemented the detection of W32/Induc-? pretty carelessly and half-heartedly. They are not going to tell us that they could not get hold of any infected SysConst.DCU, are they?

A remark on careless detection implementation:
Sophos and Kaspersky both reported about W32/Induc more or less on the same day. Sophos seems to have detected any infected file reliably from the start (telling from the Virustotal results I have seen). Yet, KAV kept on missing the infection inside the T.C. plugins wcx_ICLRead_1.4.1.zip and wlx_ICLView_5.5.2009.zip till August 20th, 2009, although it correctly flagged other infected files. Avira's detection rate seems to have been somewhat doubtful as well. - Maybe the AV producers did not care too much about W32/Induc, because its only payload currently is infecting Delphi development environments?

Eitan, thanks for fixing your plugins so quickly. (1), (2)

Kind regards,
Karl

[eitang]

karlchen,

>> Eitan, thanks for fixing your plugins so quickly

You're most welcome.

I was panicked!!! I have 6 free softwares on my site, all viruse'd. Imagine the users who do not know it does nothing, start getting warning from their AV programs and writing to me...