Check this out..

Status
Not open for further replies.

Osiris

Golden Master
Messages
36,817
Location
Kentucky
RIAA either wrote this or had it written and distributed it. Ever heard of it?

Sophos virus analysis: W32/Nopir-B
W32/Nopir-B is a worm for the Windows platform.

W32/Nopir-B will display an anti-piracy image on the screen when run. The worm will then delete all COM and MP3 files from the computer. The worm will also disable taskmanager, registry tools, and access to the control panel. W32/Nopir-B will also check for debuggers and may attempt to disable any such software that it finds.

Experts at SophosLabs™, Sophos's global network of virus and spam analysis centres, have discovered a worm which has taken the law into its own hands against internet music pirates.

The W32/Nopir-B worm, which appears to have originated in France, spreads via peer-to-peer file-sharing systems posing as a hacked utility to make copies of commercial DVDs. However, in reality it displays an anti-piracy graphic, and attempts to delete all MP3 music files, disable various system utilities, and wipe .COM programs on the infected PC.

nopirb.jpg



"The internet is swamped with people pirating movies and music, costing the entertainment industry millions each year. The Nopir-B worm targets people it believes may be involved in piracy, but fails to discriminate between the true criminals and those who may have MP3 files they have created themselves," said Graham Cluley, senior technology consultant for Sophos. "Whichever side of the fence you come down on in regards to internet piracy, there's no debate about the criminal nature of this worm - designed to inflict malicious damage on people's Windows computers."

Internet pirates who have illegally distributed music files, movies and TV shows have been in the news recently as ISPs have been ordered in a number of cases to provide identitifying details of those individuals responsible so prosecutions can be brought against them. Last month, a Canadian man lost his job after it was found he had leaked the first episode of the eagerly anticipated BBC science fiction series "Doctor Who" onto the internet three weeks before its official broadcast.

Although there have only been a small reports of the worm, Sophos recommends computer users ensure their anti-virus software is up-to-date, and that companies protect themselves with a consolidated solution which can defend them from the threats of both spam and viruses.
 
Hahaha I think Warez just got the virus. I will say this as much as I hate piracy I did not design this worm.

But I fully support some of it's features besides the controll panal and the registry. I hope that no anti virus company will add this gem to it's definition file. About time a virus writer did something usefull.
 
Warez Monster said:
Although there have only been a small reports of the worm, Sophos recommends computer users ensure their anti-virus software is up-to-date, and that companies protect themselves with a consolidated solution which can defend them from the threats of both spam and viruses.

I read this to mean that most anti-virus company see this as a virus, therefore they will stop it.. Why would RIAA ever build something like this when they know that legitimate anti-virus software will stop it?!

it's prob just someone who's bored with making normal viruses and made a toy..
 
That it is aimed at music pirates is not in doubt, as when the worm-carried program is run it displays an image on the infected computer with an anti-piracy message. It then deletes all MP3 files it finds, along with files with a “.com” extension. Of course the key here is “all MP3 files", again, legitimate or not.

It also affects a userÂ’s ability to access taskmanager, registry tools, and the control panel, making it nearly impossible to stop and remove once a system is infected.

Suggestions that this worm has been unleashed by the RIAA seem to be unfounded, although there was discussion several months ago that a certain consultant to the RIAA had been paid to create just such a software program.

As always, the best way to protect yourself is to make sure that your anti-virus software is working, and that its definitions are up-to-date.
 
Yeah I know I'm must a bit amused at the thought of a moral virus for once. I hope that the code goes open source to the underground virus community and then a Nopir-C can be made that only destroys the mp3 and other commonly pirated file extensions. Ligit or not it's still worth it since it only spreads in P2P networks so almost all is not ligit. after all if it was ligit you wouldn't be on a P2P network.
 
Status
Not open for further replies.
Back
Top Bottom