The Delphi INDUC A virus Anatomy - Felix John COLIBRI.

• abstract : the WIN32 INDUC A : virus technique, source code, and threat evaluation. How to detect, heal and protect yourself from this virus which uses Delphi 4 to Delphi 7 compiled .EXE files
  
• key words : virus - INDUC A - self copying code - anti virus - SYSCONST.PAS
  
• software used : Windows XP Home, Delphi 6
  
• hardware used : Pentium 2.800Mhz, 512 M memory, 140 G hard disc
  
• scope : any Windows PC
  
• level : Delphi developer
  
• plan :
  
  • The INDUC-A virus buzz
    
  • The WIN32 INDUC A virus facts
    
  • The Anatomy of the Delphi Induc-A Virus
    
  • The WIN32.INDUC.A virus source code
    
  • Additional Conclusions
    
  • Your Comments
    
  • INDUC A References
    

1 - The INDUC-A virus buzz

    Delphi-"virus": check your installed Delphi!

Currently, typing "INDUC-A" on Google.Com presented over 40,000 links on August 24th, and is still spreading (over 65,000 12 hours later, this morning, the 25th). And even 65,001 with this article !

This article will

• summarize the threat
  
• present and analyze the virus source code
  
• present some facts we can derive from the source analysis
  
• add some miscellaneous comments of our own
  
• list some of the (65,001) links about this virus
  

2 - The WIN32 INDUC A virus facts

• the virus is contained in (many) .EXE that were compiled with Delphi 4.0, Delphi_5.0, Delphi 6.0 and Delphi 7.0 and then distributed
  
• the technique used is the following : when an infected .EXE is executed on a PC where Delphi 4 to 7 are installed
  • it infects (duplicates itself) in SYSCONST.DCU
    
  • all Delphi programs compiled on this PC will be infected
    
  • when those .EXE are distributed on other (clean) PCs where Delphi 4 to 7 are installed, the process repeats itself
    
  The net effect is
  • on PCs WITHOUT Delphi 4 to 7 installed, some .EXE are simply 5K fatter
    
  • on PCs WITH Delphi 4 to 7 installed
    
    • SYSCONST.DCU will be 5K fatter
      
    • all Delphi programs compiled after the infection will be 5K fatter and might spread the virus when distributed
      
  It does no harm :
  • it only sits in some .EXE on PC without Delphi 4 to 7
    
  • it and will duplicate itself after compilation of Delphi code on PCs with Delphi 4 to 7 installed
    
• on the detection front
  
  • ALL the main Anti Virus softwares currently detect the virus since August the 19 th, although usually with too much concern
    
  • a simple analysis of a 40 character ASCII signature in an .EXE will unearth it
    
• to heal a PC, one should
  
  • remove it from SYSCONST.DCU (if present on the PC)
    
  • remove it from all the .EXEs
    
• the only real thread is that the technique could be used for a more dangerous virus. But then, we are no longer talking about INDUC-A but of another virus
  

3 - The Anatomy of the Delphi

3.1 - Analyzing the Virus

3.2 - Installation of an infected application

For the INDUC-A virus

• this application has been built by Delphi (version 5 to 7)
  
• therere contains
  
  • the binary (compiled) accounting code
    
  • the compiled code of SYSCONST.PAS. This unit is delivered with every Delphi .EXE, since it contains some very basic constants like :

    Const SLongMonthNameJan = 'January'

    The compiled code includes :

    • the compiled code of the original Consts
      
    • the INDUC-A virus (in black)
      

3.3 - Running the Infected .EXE on a Delphi 4 to 7 PC

In this case, the memory map will be:

and the Delphi parts that will be used by the INDUC-A virus are

• the (virus free, for now), compiled version of SYSCONST.DCU (in LIB)
  
• the (virus free) source code SYSCONST.PAS (in RTL\SYS\)
  
• the command line compiler DCC32.EXE (in BIN)
  

Those sources were included since Delphi 1, as a example to help component creator to write their own components, or to serve as an teaching example of very powerfull libraries. Those sources are in the SOURCE\ directory, like, in our case

    C:\Program Files\Borland\Delphi6\Source\

and the SYSCONST.PAS is in a sub-directory

    C:\Program Files\Borland\Delphi6\Source\Rtl\Sys\

For day to day work, the installation also creates the compiled versions of those source code .PAS Units, and places them int the LIB\ directory. In our case:

    C:\Program Files\Borland\Delphi6\Lib\

In fact, we could throw away the SYSCONST.PAS, since the compiler only uses the SYSCONST.DCU Unit.

The DELPHI32.EXE is the Delphi tool itself (the IDE), and this IDE starts its own compiler when needed.

However, to automate the recompilation of some big libraries, we can use some script compilation (BUILD or MAKE type of scripts), and those use the dedicated DCC32.EXE command line compiler. This compiler does exactly the same thing as the integrated compiler, but can optionally be used for batch compilation.

3.4 - Executing the infected Accounting.Exe

This automatic execution is caused by the Pascal Unit initialization code :

• a Unit may contain statements just before the end of the Unit. Those statements are written between Begin and End., or between Initialization and Finalization. Like this:

  Unit u_compute;   Interface     Function f_pi: Double;   Implementation     Function f_pi: Double;       ooo   Begin     ShowMessage('Hello World');   End.

  Of course, for real life Units, the end statement would be used to initialize some data or start some mandatory handling.

• the U_COMPUTE.PAS Unit is compiled into a U_COMPUTE.DCU binary
  
• finally the compiler (more accurately the Linker) assembles all the .DCUs to build a single .EXE

• when the .EXE is loaded,
  
  • first the initialization code of all Units is run
    
  • after that the control is handed over to the Begin of the main Program
    

• the virus has infected SYSCONST.DCU by adding a replicating code which is called in the SYSCONST initialization part
  
• the replicating code will infect the (clean) SYSCONST.DCU of this PC
  

At this stage nothing else happen. We just have a SYSCONST.DCU with is a little bit fatter (around 5 K more), but everything will work just fine.

3.5 - Compilation of another Delphi Application

So let's assume that you want to add some improvements to the INVENTORY application:

• you make the changes to the .PAS
  
• you compile
  

So what ?

Well, if you only use your Delphi .EXE on this machine, nothing else will happen. Running INVENTORY.EXE cannot infect more SYSCONST.DCU than it already is.

At this stage, the only effect of the virus was to increase the size of SYSCONST.DCU by 5 K. Big deal !

3.6 - Distributing INVENTORY.EXE

Let's stress again, that

• if those PC do not have Delphi 4 to 7 installed, nothing will happen
  
• if they are already infected, nothing more will happen to them
  

Etc etc

3.7 - How is SYSCONST.DCU infected ?

Here are the key points

• the virus is written in Delphi.
  
• it contains two parts
  
  • the Pascal source statements that infect SYSCONST.PAS and compile it into SYSCONST.DCU
    
  • a Pascal String Const which contains this same code, but as a litteral string constant
    

When this part is run, it should add to the clean SYSCONST.PAS this same source code. However, once this part is compiled, it is transformed into 386 binary, and the source code has been lost.

To solve the problem, the virus contains, as a first part, a litteral constant containing the litteral string of the infecting part:

and the copy__k_infect_pas__intto__sysconst_pas statement simply copies this string litteral into SYSCONST.PAS (more accurately, copies the string litteral and the corresponding pascal code).

Finally the code is inserted into SYSCONST.PAS. This Unit mainly contains an Interface part where the constants are defined, but no Implementation code:

Therefore the virus simply installs himself after the Implementation. So the infected SYSCONST.PAS will look like :

3.7.1 - The SYSCONST.DCU at work

Suppose that this SYSCONST.DCU is included in INVENTORY.EXE.

When INVENTORY.EXE is run on a clean machine :

• all the initialization of Units will be called.
  
• therefore infect_pas will be called
  
• the binary code of this Procedure will then
  
  • locate SYSCONST.PAS
    
  • copy the k_infect_pas constant in SYSCONST.PAS like this :

  • locate DCC32.EXE and compile SYSCONST.PAS into SYSCONST.DCU, which now also contains the virus :

• the virus saves the original SYSCONST.PAS, modifies SYSCONST.PAS, compiles it into SYSCONST.DCU and then reinstalls the original SYSCONST.PAS to cover its tracks
  
• the copying is performed in 3 parts, since the Implementation must contain
  
  • a new Uses Windows clause
    
  • the string constant
    
  • the statements
    
• the location of SYSCONST.PAS, SYSCONST.DCU and DCC32.EXE is performed by looking into the Windows Registry. This is the snapshot of our Delphi 6 registry entry:

• the quotes inside of the string constants strings have been changed into "$". We assume this was an attempt to obfuscate a binary dump of the infected code

  For instance, the copying statement of the string in SYSCONST.PAS is :

  For l_file_handle:= 1 To 23 Do   writeln(l_new_file_to_modify, ''''+ sc[l_file_handle], ''',');

  and the string litteral included in the .EXE is defined by

  Var sc: Array[1..24] Of String= (        'uses windows; var sc:array[1..24] of string=(',           'l_file_time_1, l_file_time_2, l_file_time_3: FILETIME;',           ooo              'for l_file_handle:= 1 to 23 do',             ' writeln(l_new_file_to_modify, ''''+ sc[l_file_handle], ''',');',           ooo

  Now this constant has been obfuscated into into :

  Var sc: Array[1..24] Of String= (        'uses windows; var sc:array[1..24] of string=(',           'l_file_time_1, l_file_time_2, l_file_time_3: FILETIME;',           ooo              'for l_file_handle:= 1 to 23 do',             ' writeln(l_new_file_to_modify, $$$$+ sc[l_file_handle], $$$,$);',           ooo

  and an hex dump would show

      writeln(l_new_file_to_modify, $$$$+ sc[l_file_handle], $$$,$);

  which, because of the "$$$$" does not look very Pascal like. Well, to non Pascal programmers...

  Anyway, this "$" substitution explains the purpose of the f_change_dollar_into_quote which changes the "$" back into a quote.

• finally, in this f_change_dollar_into_quote procedure, the "$" is coded as #36 and the quote #39.
  

4 - The WIN32.INDUC.A virus source code

We renamed the identifiers and added some comments, but the source is the source found on Gun SMOKERS site. Or, more exactly, the source of the guy who wrote the virus in the first place !. And guess what, the feller forgot to put a Copyright on it !

The algorithm is quite straigtforward:

• the code is started from the initialization of SYSCONST
  
• the infect_and_compile procedure :
  
  • checks if HKEY_LOCAL_MACHINE contains any of the following key :
        Software\Borland\Delphi\4.0
        Software\Borland\Delphi\5.0
        Software\Borland\Delphi\6.0
        Software\Borland\Delphi\7.0
    
  • if this is the case, extracts the "RootDir" value
    
  • calls modify_compile_erase, handing over the locations and names of SYSCONST.PAS, the LIB directory and DCC32.EXE
    
• modify_compile_erase then
  
  • opens SYSCONST.PAS
    
  • inserts after Implementation, both the litteral string and the statement. This is the most tricky part:
    • it first inserts the USES Windows clause required by all the RegOpenKeyEx, CreateProcess kind of calls)
      
    • then adds the string constant (hence the quoting activity)
      
    • finally copies the text after the litteral constant, changing the "$" into "'" on the fly
      
  • start the compilation of SYSCONST.PAS into SYSCONST.DCU
    
  • then covers its track
    

5 - Additional Conclusions

5.1 - The dry facts

5.2 - Virus multiplication

The answer is given by the test at the start of infect_and_compile:

Since the virus looks for Delphi 4.0, 5.0, 6.0 or 7.0,

• all the non Delphi .EXE (Word, Excel etc) will NEVER be infected
  
• it NOT contained in .DLLs, drivers, system files, activex or scripts of any kind. Only in some Delphi 4 to 7 compiled files
  
• the Delphi 8.nnn 2005.nnn, 2006.nnn, Delphi 2007.nnn, Delphi 2009.nnn, Delphi 2010.nnn compiled files cannot and will NOT be infected,
  
• even the Delphi 4.nnn, Delphi 5.nnn, Delphi 6.nnn, Delphi 7.nnn where nnn is greater than 0 will NOT be infected
  
• ONLY the Delphi 4.0, Delphi 5.0, Delphi 6.0, Delphi 7.0 MIGHT be infected, after compilation or recompilation by those Delphi versions (not if you recompile on any of the non Delphi 4.0 to 7.0 Delphi version)
  
• if you move to a newer version of Delphi (Delphi 2006, Delphi 2007, Delphi 2009, Delphi 2010), recompiling the sources of an infected .EXE will remove the virus from this .EXE
  

5.3 - Detection of the Compile-A Virus

• the string litteral constant
  
• merged in the 386 binary code, the strings used to look into the registry, open and copy the files, start the compilation
  

• the compile Const area contains the original SYSCONST.PAS "January" string:

  0280: FF FF FF FF 03 00 00 00 4E 6F 76 00 25 12 53 53 : ÿÿÿÿ.... Nov.%.SS < 0290: 68 6F 72 74 4D 6F 6E 74 68 4E 61 6D 65 44 65 63 : hortMont hNameDec < 02A0: 8A CE 35 74 9A 04 02 18 FF FF FF FF 03 00 00 00 : èÎ5tš... ÿÿÿÿ.... < 02B0: 44 65 63 00 25 11 53 4C 6F 6E 67 4D 6F 6E 74 68 : Dec.%.SL ongMonth < 02C0: 4E 61 6D 65 4A 61 6E 8A 8C C7 B5 0D 04 02 20 FF : NameJanè îǵ... ÿ < 02D0: FF FF FF 07 00 00 00 4A 61 6E 75 61 72 79 00 25 : ÿÿÿ....J anuary.% < 02E0: 11 53 4C 6F 6E 67 4D 6F 6E 74 68 4E 61 6D 65 46 : .SLongMo nthNameF < 02F0: 65 62 8A 02 E7 B9 E4 04 02 22 FF FF FF FF 08 00 : ebè.ç¹ä. ."ÿÿÿÿ.. < 0300: 00 00 46 65 62 72 75 61 72 79 00 25 11 53 4C 6F : ..Februa ry.%.SLo <

• it contains the string litteral of the virus code. Here is the first CreateFile call :

  0040: 00 00 62 65 67 69 6E 00 00 00 FF FF FF FF 5C 00 : ..begin. ..ÿÿÿÿ\. < 0050: 00 00 6C 5F 66 69 6C 65 5F 68 61 6E 64 6C 65 3A : ..l_file _handle: < 0060: 3D 20 43 72 65 61 74 65 46 69 6C 65 28 70 63 68 : = Create File(pch < 0070: 61 72 28 70 5F 73 6F 75 72 63 65 5F 74 6F 5F 6D : ar(p_sou rce_to_m < 0080: 6F 64 69 66 79 5F 77 69 74 68 6F 75 74 5F 73 75 : odify_wi thout_su < 0090: 66 66 69 78 5F 69 6E 5F 4C 49 42 5F 66 69 6C 65 : ffix_in_ LIB_file < 00A0: 5F 6E 61 6D 65 2B 20 27 62 61 6B 27 29 2C 00 00 : _name+ ' bak'),.. <

• and it contains, merged into the 386 code, the string litterals like 'bak', 'pas', or, more significantly 'Software\Borland\Delphi\' and '\source\rtl\sys\SysConst'

  03F0: 00 00 5C 62 69 6E 5C 64 63 63 33 32 2E 65 78 65 : ..\bin\d cc32.exe < 0400: 22 20 00 00 00 00 FF FF FF FF 0E 00 00 00 5C 6C : " ....ÿÿ ÿÿ....\l < 0410: 69 62 5C 73 79 73 63 6F 6E 73 74 2E 00 00 FF FF : ibsysco nst...ÿÿ < 0420: FF FF 18 00 00 00 5C 73 6F 75 72 63 65 5C 72 74 : ÿÿ....\s ourcert < 0430: 6C 5C 73 79 73 5C 53 79 73 43 6F 6E 73 74 00 00 : l\sys\Sy sConst.. <

  
  

The code of the virus is (intentionally I guess) written with quite short identifiers :

• the function converting "$" is called e (which we renamed f_change_dollar_into_quote)
  
• our modify_compile_erase is called re, and the parameter
  
• our p_source_to_modify_without_suffix_in_LIB_file_name is named d
  
• our l_file_handle is h
  

   h:=CreateFile(pchar(d+'bak'),0,0,0,3,0,0);

and because of the "'" quote into "$" obfuscation, it became

   h:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);

Therefore looking for this string will prove that the inspected SYSCONST.DCU or any other .EXE is infected. And sice a PC does not contains thousands of .EXEs, this is still reasonably manageable.

Also not that since this kind of virus has its source (as a litteral constant embedded in the .EXE), it can easily be extracted from the .EXE, and this is obviously what Gun SMOKER did. In fact, if we had an infected .EXE, it would have been easier to get the source than extracting it from the Russian translation of Gun SMOKER's article !

5.4 - Detection by AntiVirus software

We found yesterday an html link by VirusTotal which presents the analysis of some .EXE that was sent to them for examination, the 19th August. It proves that INDUC A is now detected by :

 
AntiVir 
Avast 
AVG 
BitDefender 
DrWeb 
eSave 
F-Secure 
GDataa 
Kaspersky 
McAfee, McAfee+Artemis, McAfee GW Edition 
Microsoft 
Nod32 
Sophos 
Symantec 
VirusBuster 

We found that our AVG free virus checker also detects INDUC A :

• we first included Gun SMOKER's INDUC A source in a unit and compiled it
  
• the generation of the disc .EXE was blocked by AVG:

  
  

We could compile our renamed code (in order to check that it works, and to present the binary hex dumps). And this version WAS NOT BLOCKED, which was not very surprising. Apparently, the AVG only looks for some original constant, like :

   h:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);

and not for our renamed

   l_handle:=CreateFile(pchar(
       p_source_to_modify_without_suffix_in_LIB_file_name+$bak$),0,0,0,3,0,0);

constant.

Other antivirus could be more accurate, by looking for the conjuction of 'Software\Borland\Delphi\' and '\source\rtl\sys\SysConst', for instance

We could also create our own detection project, using a fast string search (Boyer More, or HorseSpool) which we presented in several of our articles :

• The Coliget Search Engine
  
• Find Memo
  

5.5 - Overkill

And this is a shame for such an innocuous virus

5.6 - Compiling on an infected PC

• keeps the original SYSCONST.PAS intact (after saving it, modifying, compilation and restoration of the original)
  
• the virus does not modify the compiler which still works (the integrated one or DCC32.EXE)
  

5.7 - Removing the virus

Therefore we must remove the virus from all the .EXE.

We have not implemented it, but simply replacing the binary call to infect_and_compile (the virus entry point in the Initialization of SYSCONST.DCU) by as many 386 NOP should do. This should stop the infection from this .EXE.

And while we are at it, filling all the areas that the antivirus software might use for INDUC A detection by zeros would also stop the current antivirus panic nonsense.

5.8 - How was the INDUC A virus detected ?

5.8.1 - An old, harmless little feller

It has since then spread and multiplied, without anybody being harmed, or noticing anything.

Not quite, since it sometimes triggers an execution exception

5.8.2 - The Execution Exception

And the cause of the error is quite funny:

• opening SYSCONST.PAS is protected by a $I compiler directive :

  {$I-} // -- open SYSCONST.PAS assignfile(l_file_to_modify, p_source_to_modify_in_RTL_file_name); reset(l_file_to_modify); If ioresult<> 0   Then exit; ooo {$I+}

• this code is stored in the string constant :

  Var sc: Array[1..24] Of String= (    'uses windows; var sc:array[1..24] of string=(',    ooo    '{$I-}',    'assignfile(l_file_to_modify, p_source_to_modify_in_RTL_file_name);',    ooo

• and now, folks, when the virus installs itself in SYSCONST.PAS, it calls f_change_dollar_into_quote to "unobfuscate" the "$" into quotes "'". And, naturally is does the same thing for our compiler directives which now become

  {'I-} // -- open SYSCONST.PAS assignfile(l_file_to_modify, p_source_to_modify_in_RTL_file_name); reset(l_file_to_modify); If ioresult<> 0   Then exit; ooo {'I+}

  
  

• the $I becomes an ordinary comment
  
• if the code does not find SYSCONST.PAS, it triggers an execution exception.
  

The virus could only go that far if it could find the Delphi 4.0 to 7.0 registry entry, but failed to find the SYSCONST.PAS. How is this possible ? Well it might be possible to uninstall Delphi (whic removes SYSCONST.PAS) but might not clean up the registry.

Under those circumpstances, the application raised an exception :

and this is what was noticed by many Russian users.

5.9 - How did the INDUC A virus spread ?

• Miranda (a Delphi plug-in)
  
• QIP,
  
• AIMP,
  
• Infinity Box.
  

There are some lists of supposedly infected applications now available on the Web.

Annoying but not destructive.

Only on August 12th did Gun SMOKER decide to investigate, and then published his findings in his blog.

5.10 - How is it propagated today on other PCs

It is NOT propagated :

• by mail, openig attached stuff or running scripts
  
• by visiting Internet sites, even the most furious and evil ones
  
• by installing .EXE other than infected Delphi 4.0 to 7.0 .EXEs
  
• by being connected to contaminated PCs on your network
  
• by running rotten Word, Excel or Visual Basic macros
  
• by extracting ZIP files
  

• YOU installed an infected .EXE (unknowingly, for sure)
  
• YOU executed this .EXE
  

This can be pictured like this :

5.11 - Avoiding infection

• move DCC32.EXE into another directory. The virus will not find it and will be unable to compile the SYSCONST.PAS
  
• the virus also keeps a SYSCONST.BAK around and placing a bogus SYSCONST.BAK would avoid infecting the current (clean) SYSCONST.DCU
  

And if you move to a newer version of Delphi (Delphi 2006, Delphi 2007, Delphi 2009, Delphi 2010), recompiling the sources will remove the virus from the .EXE

Another technique is to use some operating system protection, especially with VISTA.

5.12 - What's Next

However it could be modified, installed on other machines, adapted to other compilers etc.

This is the real source of concern, but is beyond the scope of this article.

In fact, in an interesting blog post, Craig STUNTZ references Ken THOMPSON's Turing Award where the technique of duplicating code by a compiler could be exploited. So it's a very old technique, which was nicely implemented for Delphi as an innocent prank, but could be adapted in a far more dangerous way in the future.

The only new thing is that the virus is duplicating when you use an IDE (Delphi in this case)

5.13 - FUD - Fear, Uncertainty, Doubt

And the ball started to roll around this date.

5.14 - Conspiracy theory

But with this over information, many soon came up with all kind of conspiracy schemes. The virs COULD have been created by

• anti virus software companies, to improve their sales
  
• MAC developers who hate WINDOWS
  
• Delphi haters
  
• and anyone else you suspect does not like you
  

5.15 - Was it all right to publish the virus source ?

Next, all infected software, and in Russia there are many, contain the source of the virus (in the constant string). To get a working Delphi source code, you simply have to extract this string, and write the two part Delphi code we presented above.

In addition the truely malicious virus writer have known this technique for a long time, and this presentation will not teach them any new trick.

And finallys

• the source is not complete (the litteral constants have not all been initialized)
  
• one still has to boostrap the virus
  

Once you understand the source (or at least the technique), you can put the topic in to rest, and you will know exactly what to do if your PC should be hit.

6 - Your Comments

• we welcome any comment, criticism, enhancement, other sources or reference suggestion. Just send an e-mail to fcolibri@felix-colibri.com.
  
• or more simply, enter your (anonymous or with your e-mail if you want an answer) comments below and clic the "send" button

  Name :
  E-mail :
  Comments * :

  
  

7 - INDUC A References

• Gun SMOKER - blog Aug 12 2009
  
  • Delphi-"virus": check your installed Delphi!
    
  • the blog that exposed, explained and presented the virus
    
  You might want to use
    http://translate.google.com/
      translate?prev=hp&hl=en&js=y&u=http://gunsmoker.blogspot.com/
      2009/08/delphi-delphi.html&sl=ru&tl=en
  for the Google translated version of this page into English
  We also received a comment from "gunsmoker" telling that two other person had mentionned the exception but did not investigate. Well, HE did, and therefore he still is, in my opinion, the fist person who presented and explained the virus.

• Sophos - 18 Aug
  
  • Compile-a-virus - W32/Induc-A
    
  • one of the posts which might have vastly overstated the danger of INDUC A
    
  • they also referenced the THOMPSON's paper
    
• Craig STUNTZ - blog Aug 20 2009
  
  • On That Delphi 7 Virus and Ken Thompson's Turing Award Speach
    
  • a nice text explaining that this kind of compiler reproduced virus was known long ago
    
• CodeGear is fully aware of the virus, and several posts have been published on the topic
  • Alan BAUER - Aug 20
    
    • A Tempest in a Teapot or something more sinister?
      
  • Nick HODGES - 24 august
    
    • Frequently Asked Questions about the W32/Induc-A Virus (Compile-A-Virus)
      
• VirusTotal - 19 aug
  
  • VirusTotal
    the link is (with no spaces or line
      http://www.virustotal.com/analisis/
        8919489a83222206a8f582bf38612d925c619fd
        58196de66660ba0134074283f-1250686830
    
• Felix COLIBRI
  
  • The Coliget Search Engine
    
  • Find Memo
    
  Two projects which include fast string search routines, which could be applied to detect INDUC A
  

8 - The author