Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Warning! Glary Utilites/Iobit infected with Win32.Induc

19 Aug 2009   #11

Windows 7 Enterprise x64

Im pretty sure ESET NOD32 AntiVirus/Smart security v4 detected this virus a LONG time ago. Probably its advanced heuristics.
I remember doing the Online scan with a friend and it removed Glary utilities in the process.

EDIT: Nope NVM it was added in a update 4348:

My System SpecsSystem Spec
19 Aug 2009   #12

Microsoft Community Contributor Award Recipient

Vista x64 / 7 X64

Thanks for the info. Aaron.

Curiously , although Avast was responsible for pointing out these infections on their site - I just scanned my GUPRO (newest version ) with Avast and it comes up clean.
My System SpecsSystem Spec
19 Aug 2009   #13

Windows 7 Ultimate x64 SP1

Yeah, Glary has apparently removed the infected files in the version they just released because of this. v2.15.0.728. Sounds as if Glary and Iobit are saying it was misunderstood and picked up as infected and fixed. They're are acting as if it was just a FP, but it most likely isn't. No doubt many other programs compiled with delphi are infected.
My System SpecsSystem Spec

19 Aug 2009   #14

Microsoft Community Contributor Award Recipient

Vista x64 / 7 X64

Glad you mentioned it.

Scans of GUPRO is clean ( v2.15.0.738 )

A full scan with Avast revealed 3DImageCommander and Icon Commander as being infected. Everything else is clean.

No problem removing them from Vista.

On 7 , there were access denied messages from Avast.

The solution is to rt click on the actual infected file (not the folder) and open it, or scan - you get the Warning from Avast again - this time you can Move to Chest/Delete.

Odd permissions problem on 7.
My System SpecsSystem Spec
27 Aug 2009   #15

win xp

Yes, Avast detected infected Glary Engcrypter, registry Repair and Splitter with Win32.Induc several days ago. Luckily, now I have downloaded the new version and it's clean.
My System SpecsSystem Spec
28 Aug 2009   #16

Windows 7 32bit RTM

yea its been removed only found this on thier site ;P

*just some ad site blocked"?

Attached Thumbnails
Warning! Glary Utilites/Iobit infected with Win32.Induc-virus.png  
My System SpecsSystem Spec
28 Aug 2009   #17
Bare Foot Kid
Microsoft MVP

W 7 64-bit Ultimate

Quote   Quote: Originally Posted by Mercurial View Post
yea its been removed only found this on thier site ;P
Thanks for the update mate.
My System SpecsSystem Spec
28 Aug 2009   #18

Windows 3.11

Please don't report virus again,here is the reason.We have fixed the problems.
Glary Utilities has been updated and now it is virus-free.Please download and install it again.

Dear users of Glary Utilities,

We are very sorry for the inconvenient caused by Win32/Induc,but it is not our fault to create the virus.It is the development environment(Delphi) affected by virus that directly lead to the virus in our product.Below is the detailed reason:

Source: ... opic=93000

18 August 2009, 14:21
Virus infects development environment

Anti-virus software vendor Kaspersky has discovered a new type of virus which infects and compromises systems running the Delphi

development environment. After infection, all Delphi programs compiled using the infected Delphi environment are also infected.

Anti-virus laboratory AV-Test has already spotted the first examples in the wild.

The virus affects Delphi versions 4.0, 5.0, 6.0 and 7.0. After making a backup which it names SysConst.bak, it overwrites the

Delphi file SysConst.dcu with a self-compiled version. Since the infected file is loaded whenever Delphi programs are compiled, all

programs generated after this point will be infected.

Updated Virus writers have gone old school with the creation of a virus that infects Delphi files as they are built.

When a Delphi file infected with Induc-A virus is run, it searches for Delphi programming installations on an infected machine and

attempts to infect this installation. More specifically, the malware attempts to infect SysConst.pas, which it then compiles to

SysConst.dcu. Once this process is completed the SysConst.dcu file is programmed to add the Induc-A virus to every new Delphi file

that gets compiled on the system.

A full write-up of the malware, including a screenshot depicting strings of infected code, can be found here.

A full write-up of the malware, including a screenshot depicting strings of infected code, can be found here.

Even the vast majority of computer users that aren't Delphi developers can be affected by running programs written in Delphi that

happen to have been contaminated.

Up until Tuesday afternoon the labs at Sophos have received more than 3,000 infected files, submitted by users who have found

infections. "This makes us believe that the malware has been active for some time, and that a number of software houses

specialising in developing applications with Delphi must have been infected," writes Graham Cluley, senior technology consultant at


Examples of infections have included applications described as "a tool for downloading configuration files onto GSM modules" and "a

compiler interface that operates between our third-party design software and our CNC woodworking machinery".

Delphi is used to quickly develop Windows applications. Some of the infected files are banking Trojans written in Delphi - so some

hackers are among those hit by the virus.
This is what they said on forum!
My System SpecsSystem Spec
Closed Thread

 Warning! Glary Utilites/Iobit infected with Win32.Induc

Thread Tools

Similar help and support threads
Thread Forum
This week my main pc was infected with Ransom:win32/Croti
This week my main pc was infected with Ransom:win32/Croti. My main protection program is MS Security Essentials. I was a bit surprised since I routinely keep my virus def.s up to date & stay off of any risky (??) sites. (You’ve heard it all many timesJ) No other PC’s on my Home Network appear to...
System Security
Infected by virtool.win32/obfuscator.XZ
Hi Got up this morning to a message that I had a problem. I scanned with MSE and it found virtool.win32/obfuscator.XZ but when I tried to 'clean' the system it seemed to fail. I found a similar post in this forum and so I ran F-secure and here is the report (I think this is what you...
System Security
Infected by virtool.win32/obfuscator.XZ on Windows 7
Hi All, My last MSE scan was in October of 2012, did a scan last night and found that I'm infected with virtool.win32/obfuscator.XZ. I tried to do some research before posting and found these two threads that are relatively recent: 1. Solved: Please help removing virtool:win32/obfuscator.XZ...
System Security
Win 7 Action Center reports pc is infected with win32/ trogan
Hello, My Windows 7 action center has told me to "remove the Win32/Small.CA virus from your computer". Although it provides very little assistance in removing the virus. The message first appeared on the 26 Dec 2012. My computer has blue screened several times over the last month although...
System Security
themeui.dll infected with Win32.HLLM.Graz.based
Recently run DrWeb and got this message on Build 7000 :/ Anyone else?
System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:28.
Twitter Facebook