Specific Delphi Virus

A Delphi-specific virus has appeared on the Internet. Its essence is that the infected program searches the disk for the installed versions of Delphi and, if it finds it, modifies the SysConst.dcu file (the old version is saved as SysConst.bak), and after that all the Delphi programs compiled on this computer start also infect Delphi on those computers where they run. The spread of the virus was due to the fact that some versions of the popular QIP messenger were infected with it (the QIP development team apologizes for this). So far, the only detected harmful effect of the virus is that due to an error in its code when you run an infected program, Runtime error 3 occurs if the registry key is HKEY_LOCAL_MACHINE \ SOFTWARE \ Borland \ Delphi \ x.0 (x - 4 to 7) contains an incorrect value for the RootDir parameter (no error occurs for the correct value). Apparently, the virus spread technology was just running around.

Check your Delphi versions and, if you find SysConst.bak, do the following:
1. Remove SysConst.dcu
2. Copy SysConst.bak to SysConst.dcu. It is important to copy, not rename, so that SysConst.bak also remains on the disk - this will save the system from being reinfected.

Some details and discussion:
www.delphikingdom.com/asp/answer.asp?IDAnswer=70912
forum.qip.ru/showthread.php?t=36203
forum.qip.ru/showthread.php?t=35939
')
UPD: this topic is not intended to throw mud at QIP, AIMP turned out to be infected, I suspect that many other programs. For those who are too lazy to follow the links, the QIP developers rebuilt the build.