RIAA virus?

It's called Nopir.B. It seems to be DVD copying software but in reality it tries to delete all the mp3 files from your hard drive. It all seems a wee bit too convienient to me.

Read about it here.
or


Check out what Sophos has to say.

Call me paranoid (see sig) but I'd almost bet the farm that the RIAA is behind this one. If they're not, they'd probably be willing to pay the author's legal fees if he/she is ever caught.

/me imagines the thoughts of RIAA exec...
"we tried lawsuits, we tried legislation....let's fuxor their hard drives and see if that works."

dirty bastards...

not unlike m$ illegal media detection program for parents..listed all media as potentially copyrighted and suggested deletion

Doesn't look like a virus to me in the sense that it doesn't make copies of itself without user intervention. Just kind of hides in places accessible to other filesharers and lets them do the dirty work. I'd place it in the same category as dialers and associated trojans.

I think if the RIAA and their gazillion dollars were behind it, they would have designed a better delivery method.

This was funny though...

Quote:

---

The W32/Nopir-B worm, which appears to have originated in France,

---

France. Go figure. There's a bloody french flag on it.

Looks like big companies are in this ... to eradicate the piracy aspect of music . Even if the software deletes any files using the recover software we can get all the files back.
Sattaru

i think if it was the RIAA they would go more widespread than just p2p networks. IRC would be targeted, its easy to find full albums via xdcc bots etc using ircspy.com
i think its just another dumb kid thinking they are slick and cool for ruining peoples hard work (hence france comes to mind)

Hmmmm,

http://www.vbfrance.com/auteurdetail.aspx?ID=264139

Not exactly a "kid"?

Over here (UK) a lot of file sharing of music goes on in "newsgroups" or "bulletin boards" rather than P2P.

That is probably due to the pricing structure for internet connection. Unless you have a broadband or unlimited dial-up account you tend to have to pay your telco by the minute, so a lot of people want to download at night when the rates are cheap.

In a recent development, our version of the RIAA have started to go after 32 people for uploading copyright materials. This is a new development, as previously they were only interested in piracy (selling counterfeit copies)

I personally doubt if the RIAA are in anyway involved. However it might start to give them ideas.

I find it a bit strange though, as most people I know who download music copy it to CD/DVD to free up hard drive space. This would suggest that there are limited targets available.

The people who put up large quantities of files are hardly likely to mess around with some unknown "cracking" software? I would expect them to already have all that stuff? And this looks like a straight trojan, rather than a virus or worm?

I am at a loss to see what has motivated the guy :confused:

Quote:

---

I am at a loss to see what has motivated the guy

---

Short dick syndrome.

Others might call it the Napoleon complex.

Freud would call id a conflict between the id and the superego's ability to regulate it.

Any way you look cat it, he feels inadequate, and sees the release of this virus as a means to make himself more relevant. He can then see the effect of his actions and confirm to himself that he exists.

Quote:

---

So far as we are human, what we do must be either evil or good:
so far as we do evil or good, we are human: and it is better,
in a paradoxical way, to do evil than to do nothing: at least we exist.

-- T.S. Eliot

---

And I guess my french isn't as rusty as I thought it is.

Time for backup! If all of my music was deleted I think I might kill myself. All those hours slaving over a 56k connection, wasted. Ugh, this guy should be strung up by his 2 best freinds, if he has any.

wat is the RIAA??
has sum1 made sum protection against it r shud i stop downloading?? hehe

I'm sure they'd love to be behind it but they're not stupid. They're not going to risk fines or jail. Although I'm sure they're laughing their asses off.

The RIAA is a clandestine organisation devoted to the termination with extreme prejudice of music downloaders.

They are totally merciless and will stop at nothing, even the persecution of 12 year old girls.

If you do not believe me, please take a look at their local "station master" (chief field operative) practicing reading out your death sentence :eek:

Quote:

---

Doesn't look like a virus to me in the sense that it doesn't make copies of itself without user intervention.

---

*COUGH*

That is the definition of a virus:-

A piece of malicious software that requires user intervention to propgate. :eek:

That's where some people draw the line between viruses and worms - a virus needs user intervention, a worm does not. Other people argue that the difference is a virus attaches to other files, and a worm exists on its own. Other people say that while both worms and viruses make copies of themselves, only worms actually do anything to prpagate themselves, such as using email or remote exploits.

I disagree. A worm is designed for a specific purpose; a virus is simply designed to do as much damage as possible.

One does not "install" a virus in the same sense that one "installs" a trojan. To require user intervention to propagate, a virus in most cases would have to disguise itself as something else. Therefore it would be a trojan.

Calling it a virus gives people the impression that there's nothing they can do to avoid being attacked by it, when in fact they only need to refrain from downloading it.

But it's all just semantics anyway. They're all bad, and we all know the basic principles behind how they operate. There's about as many definitions for viruses and worms as there are for hackers and crackers (lets not get into that one).

Quote:

---

A worm is designed for a specific purpose; a virus is simply designed to do as much damage as possible.

---

Oh.. I don't know about that. IIRC, Sasser was designed to inflict damage (rumored as an attempt to drive more customers to the worm writer's mother's PC repair shop). In my opinion the differences are similar to what Tiger has put forward.

Worms: propogation is self-initiated. The worm usually attempts to find other machines -- based on a code pattern -- that are also vulnerable (hence, why many firewalls go somewhat nuts during larger outbreaks).

Virus: propogation usually requires some user intervention (e.g., click here, run a macro, etc.) in the traditional sense. (remember that viruses can have a variety of vectors: MBR, macro, memory, etc.)

Trojan: a program bound to another program. Usually the other program is benign (e.g., Whack-a-Gopher) and is designed to encourage the user to play. Additionally, many trojans are of a client/server concept. Client is run by the "bad guy" while the server runs on the "victim".

Perhaps I'm more traditionalist in my definitions.

STFU! I AM NEVER WRONG! ME ME ME ME ME!

This seems more to be an argument over what actually constitutes "user intervention" than the difference between worms and viruses.

Granted, a virus does require *some* kind of user action. But these actions are not above and beyond what a user would normally do and fall within the description of normal activity. A virus will replicate itself when a user loads some program or another according to instructions contained within it. A trojan, on the other hand, actually requires the user him / herslef to make that copy. It has no instructions to make copies of itself.

Looking at a few of the more common baddies, your definitions appear to be more correct than mine. My point was this though: A virus will copy itself without the user knowing that a copy of anything has been made. A trojan (or its host program) must be copied intentionally.

A worm, however, definitely requires no user action of any kind.

I AM NEVER WRONG!

err... maybe this *one* time...

Quote:

---

A trojan (or its host program) must be copied intentionally.

---

This I don't know about. Recently, there has been spyware that has trojans in them (mostly keylogger types but they are trojans nonetheless). I'm quite sure that many individuals do not intentionally infect themselves with spyware (unless they are me! :D). That said, it almost makes the spyware/trojan combination a form of a virus (user intervention required).

Well I would say it was a classic trojan............it is a program that purports to do one thing and actually does something (unwanted) else. This one pretends to be cracking software, but isn't?

A virus, by definition, has to infect. This could be by attachment or injection into a file or entering the boot sector. Infection, just like a biological virus.

A trojan requires human intervention............remember they had to take the horse into Troy?

The only distinction that a virus has is that it MUST infect.

So it is possible to have viral worms. These would not require human intervention.

At least those are the classic definitions ;)

And a virus does not have to do any damege, many do not have a payload. I distinctly remember the old days when there was some sort of competition as to who could make the smallest virus.....they didn't have room for a payload :D

Also "proof of concept" viruses generally don't have payloads, for example the Microsoft Word POC macro virus.

:)

EDIT: MsM, a trojan does require human intervention..............just like it says in Homer's Illyad.

What you might be confusing is the payload............a keylogger is a payload?

Quote:

---

I distinctly remember the old days when there was some sort of competition as to who could make the smallest virus

---

Or the ones which were "annoyances" like Ambulance (little ambulance goes across the screen at random times) or Jester (pops up to tell a joke).

Quote:

---

This I don't know about. Recently, there has been spyware that has trojans in them

---

True. But spyware finds its way onto a system by masquerading as something else (i.e. CoolWebSearch). I am not implying that the user must first be aware of the fact that they are installing a trojan. Spyware in this manner does not continue to infect more files on the system once its payload has been delivered either. To infect another computer, it must again be downloaded from a fileserver somewhere and installed on another system. A server/client infection technique, where a virus uses a peer to peer method.

I guess in this sense, a trojan is designed for a purpose (market research or key logging, in your example), whereas a virus simply inflicts damage. A trojan is usually constructed to operate symbiotically with its host program, while a virus can infect any number of programs.

But now the definition af a virus begins to blur again. Say it's running in memory, and infecting all outgoing emails. In one sense it needs the user to create those emails, but in another sense it is independently searching for those emails.

I guess we could say that a worm replicates and propagates independently, but a virus merely replicates. A trojan does neither. I think those are good definitions as far as infection methods are concerned.

What about payload then?

A trojan is designed for a purpose, as stated above. A virus, perhaps, causes some kind of damage to the host system, whereas a worm simply replicates itself; the damage is indirectly caused by the bandwidth spikes.

I always cosidered malware a worm when it was designed for something like passwrod sniffing or network mapping, whereas a virus might simply delete random files.

I agree with Nihil about this one, though. Definitely a trojan in that it appears to be one thing and is in fact something else.

[edit]
My favorite virus was the Cookie Monster virus. You had to give him an oreo before he would go away.
[/edit]

Quote:

---

Recently, there has been spyware that has trojans in them

---

These are called Blended Threats insofar as the _payload_ can be any number of things. What differentiates viruses and worms is the trigger mechanism. A virus requires a user to click on an attachment, link or whatever in order to trigger the malicious code. A worm automatically propogates by locating computers running the service(s) that are vulnerable to it's built in exploit(s) and infecting them without the use of a human, (it's trigger is the successful infection of the new host).

Once the virus or worm is "on target" what results is called the payload. The payload in the case of the "classic" virus is the generation of new email to all the email addresses it can harvest from the new victim which contain a new copy of itself. The payload in the case of the "classic" worm is the code required to locate and infect he next victim down the line.

There has been a trend over the last few years to add "goodies" to the payload portion of both worms and viruses so that their "functionality" is "enhanced" hence the label Blended Threat.

Trojans are a different beast altogether. As in ancient history the Trojan Horse was something it did not appear to be... It appeared to be a gift/memorial to the failed seige. It turned out to be an attack mechanism, (for the uninformed - warriors were hidden inside and attacked after dark, opening the gates to the city to let the rest of the army to enter). This is what a Trojan is in computer terms - a piece of malicious code that purports to be something good, (a cool utility, game or whatever), while what it really is intended to do is to breach the security of the host computer. Typically, the "classic" Trojan opened a port and listened on it giving the attacker remote access to the infected computer.

The problem is that Trojans have become so synonymous with Remote Access that anything that grants remote access is now called a Trojan. This is wrong!!!! A worm that carries, as part of it's payload, a remote access "device" still is not a Trojan, it's a worm with multiple payloads, (a Blended Threat).

It's very important that we use the correct terminlogy when discussing these different entities or all we end up doing is confusing both ourselves and the other readers.

Not picking on Ms. M. - I just see so much of this mis-naming/identifying of these threats that I finally got fed up.... ;)

Quote:

---

Not picking on Ms. M. - I just see so much of this mis-naming/identifying of these threats that I finally got fed up....

---

I wouldn't view it as picking on.. It's always good to get clarification.

Quote:

---

The payload in the case of the "classic" virus is the generation of new email to all the email addresses it can harvest from the new victim which contain a new copy of itself.

---

I'm curious as to what is "classic" since virus have been around for a while and using email as an attack vector/propogation is a relatively new thing ("I Love You" was the first, no? This would place it around 2000 and yet, virus have been around since the 70s (one site I found suggests that Elk Cloner was the first wild virus -- circa 1981).

Perhaps the "neo-classical" virus use email as it's form of propogation?

Quote:

---

Perhaps the "neo-classical" virus use email as it's form of propogation?

---

Ok.. I can live with that... It's more a thing that most people today see the email vector as the most prevalent and many don't remember floppy disks.... :D

Quote:

---

It's more a thing that most people today see the email vector as the most prevalent and many don't remember floppy disks....

---

I do. I still use them and in fact, still have a 3Com diagnostic disk that has the NATAS MBR virus on it (nasty beastie). ;)

LOL... I never saw you as that old my dear... ;)

Yes, they are still used, and somewhere at home I have a collection of stuff like Stoned etc. but they probably don't work any more.... I just dread to think how many years ago the last Boot sector infector was written and released into the wild.... It's propagation rate would be worse than snail mail... :D

Virus, worm, trojan, whatever. I dont want one on my computer in any case.