Sophos is not false alarming on the Delphi Induc virus

Sophos is not false alarming
Robert Poston over in the Vancouver branch of SophosLabs has posted an recently reported W32/Induc-A virus.

As Robert explains, in all cases Sophos’s detections were shown to be legitimate and the files were infected. Indeed, it seems that it is very unlikely that we will ever see a false positive from Sophos regarding this unusual Delphi code virus – so if we say a file is infected, it is!

It’s possible that some of the disbelief may have come about because users have misunderstood media reporting of the virus, and believe that only Delphi software houses can contract the malware.

However, if you’re a regular run-of-the-mill user you can still download or install code which a Delphi programmer doesn’t realise was tainted by W32/Induc-A. Furthermore, you might pass the malware on to other computer users who may have Delphi installations on their computer. So it would be wise for everyone to ensure that they have proper protection in place.

Sign up to our free newsletter.
Security news, advice, and tips.

And if you do find an infection, tell the vendor or internal department who produced the software – so they can clean up their systems.

Meanwhile, if you’re a Delphi developer, and you believe you may have been infected by this virus, please send us samples of your SysConst.dcu, SysConst.bak and SysConst.pas files. We are especially interested if you have customized versions of these units.

There is more good advice in Robert’s blog entry.


Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.