Vigilante worm attacks music-sharers

[Tami]

Vigilante worm attacks music-sharers
By JACK KAPICA

Someone out there appears to agree with the music industry on the issue of copyright "piracy" — the vigilante has created a virus that wipes MP3 files from infected computers.

Technically a computer worm, the virus, called Nopir-B, appears to have been written by a French hacker, says the London-based security company Sophos Labs, which found it in the wild late yesterday.

Nopir-B spreads along peer-to-peer file-sharing systems posing as a program to make copies of commercial DVDs. If opened, it displays an anti-piracy graphic, and attempts to delete all MP3 music files, disable various system utilities, and wipe other programs on the infected computer.

"The Nopir-B worm is designed to inflict malicious damage on people's Windows computers and targets those who may be involved in piracy, however the worm fails to decipher between the true pirates and those who may have obtained MP3 files legally," Sophos security analyst Gregg Mastoras said in a statement.

When the U.S. recording industry started launching lawsuits against file-sharers a few years ago, a spokesman for the industry suggested it would consider creating a virus that would do much the same thing, but the Canadian industry quickly distanced itself from the vigilante and the worm.

"I can tell you categorically that [the Canadian Recording Industry Association] and its members have absolutely nothing to do with this, and to my knowledge the record industry worldwide has absolutely nothing to do with it," said CRIA legal counsel Richard Pfohl.

Mr. Pfohl said the appearance of the worm emphasizes the need for people to acquire music and other intellectual property through legitimate services. Peer-to-peer networks are among the greatest disseminators of computer viruses and violate privacy (including identity theft), and expose people to child pornography. They are also culled for e-mail addresses by spammers.

"I'm surprised that none of the purported Internet public-interest groups ... has warned consumers about the multitude of dangers from P2P services," Mr. Pfohl added. "They claim to be concerned about Internet privacy, spam and other threats to Internet users, but apparently they don't believe such a warning is in the public interest."

The ultra-fast Internet2 network that connects universities researching the next-generation Internet has become popular among college students who download music and movies on peer-to-peer networks. This month in the United States, the Recording Industry Association of America, the music industry trade group, filed federal lawsuits against more than 400 students at 18 colleges with access to the Internet2 network.

Also this week, the Canadian Recording Industry Association appeared in an appeals court in Toronto asking it to overturn a federal decision last year that declared Internet service providers should not be forced to hand over alleged infringers' real names based on an IP address that made hundreds of music files available on peer-to-peer networks Kazaa and IMesh.

Last month, a Canadian man lost his job after it was found he had leaked the first episode of the eagerly anticipated BBC science fiction series Doctor Who onto the Internet three weeks before its official broadcast.

"The entertainment industry has taken piracy quite seriously for some time now especially as technology and the Internet has made sharing copyrighted songs and films far more easier," Mr. Mastoras said.

"We are likely to see more vigilante-type worms in the future."

Sophos reported that it has not seen a great number of reports about the worm, meaning it is not a great threat at this point. The company recommends that computer users update their antivirus software to prevent it from spreading.

Viruses that can zap MP3 files are rare, but not new. The Klez-F worm, widespread in 2002, overwrote MP3 files on certain days of the month. The Scrambler worm made MP3 files sound like a scratched record, while the Mylife-G worm overwrote MP3 files with the words "my lIfE."

But none of these worms has appeared on file-sharing networks, as has Nopir.

Nopir affects only those computers running the Windows operating system. When run, it displays an anti-piracy image on the screen, which shows a message from "The French Hacker" superimposed on a French flag, and then proceeds to delete all .COM and MP3 files from the computer.

The worm will also disable Task Manager, registry tools, and access to the control panel, and check for debuggers, which it will attempt to disable.

Nopir copies itself to the Projects Visual Studio.NET directory under a random name, and changes a number of registry keys.

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20050422.gtwormapr22/BNStory/Technology/\"]source: GlobeTechnology[/url]