Found this article through some dutch news-sites...
Thought you'd like to know, if you didn't already knew it...
http://www.sophos.com/virusinfo/articles/nopirb.html
nopir-b, weed it and reap...
Moderator: CricketMX Forum Moderators
/|\
/|\ has a strict policy concerning disclosure of identity, showing of
light sabers, affiliationado's, multiple account users, drinking buddies who
join the same community they see me visit for years, and board hoggers
(whatever that means).
The policy is: If it doesn't bother me, I don't give a flying f4ck.
/|\ has a strict policy concerning disclosure of identity, showing of
light sabers, affiliationado's, multiple account users, drinking buddies who
join the same community they see me visit for years, and board hoggers
(whatever that means).
The policy is: If it doesn't bother me, I don't give a flying f4ck.
Not good at all, you can't help but think it was the work of some certain authorities..
CricketMX.com in 2022: Still the home of bat's, rat's and other farmyard animals!
"OK, life [as you chose to define it] repeats until there are no more lessons to be learned." - nrnoble (June 12, 2005)
"the new forum looks awesome, it's getting bigger & better" - p2p-sharing-rules (11 Jan, 2008)
"Looks like CMX is not only getting bigger...but, also getting better!!" - moongirl (14 Dec, 2007)
"OK, life [as you chose to define it] repeats until there are no more lessons to be learned." - nrnoble (June 12, 2005)
"the new forum looks awesome, it's getting bigger & better" - p2p-sharing-rules (11 Jan, 2008)
"Looks like CMX is not only getting bigger...but, also getting better!!" - moongirl (14 Dec, 2007)
-
quicksilver
- Helpful Hands
- Posts: 1926
- Joined: Mon Mar 22, 2004 12:12 am
Very Worrying
Seems to be Something discovered on emule from the above.
this could save people a lot of distress
W32/Nopir-B copies itself to <Program Files>\Projects Visual Studio.NET\Nctrup.exe, <Program Files>\Restore\<random name>.exe, <Program Files>\eMule\Incoming\AnyDVD 5.1.0.1 Crack+Keygen By Razor.exe.
Seems to be Something discovered on emule from the above.
Very well spotted Threewing,Summary Description Recovery Advanced
This section is for technical experts who want to know more.
W32/Nopir-B is a worm for the Windows platform.
Once active the worm will then delete all COM and MP3 files from the computer. The worm will also disable taskmanager, registry tools, and access to the control panel. W32/Nopir-B will also check for debuggers and may attempt to disable any such software that it finds.
W32/Nopir-B copies itself to <Program Files>\Projects Visual Studio.NET\Nctrup.exe, <Program Files>\Restore\<random name>.exe, <Program Files>\eMule\Incoming\AnyDVD 5.1.0.1 Crack+Keygen By Razor.exe.
W32/Nopir-B will create the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Verif
<Program Files>\Restore\<random name>.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
securw
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\exefile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\batfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\comfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\scrfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\piffile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\vbsfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\vbefile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoControlPanel
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
this could save people a lot of distress