Nopir worm fights pirates by wiping MP3 music files, Sophos reports

Sophos Press Release

Experts at SophosLabs™, Sophos's global network of virus and spam analysis centres, have discovered a worm which has taken the law into its own hands against internet music pirates.

The W32/Nopir-B worm, which appears to have originated in France, spreads via peer-to-peer file-sharing systems posing as a hacked utility to make copies of commercial DVDs. However, in reality it displays an anti-piracy graphic, and attempts to delete all MP3 music files, disable various system utilities, and wipe .COM programs on the infected PC.

The image displayed by the Nopir-B worm
The image displayed by the Nopir-B worm.

"The internet is swamped with people pirating movies and music, costing the entertainment industry millions each year. The Nopir-B worm targets people it believes may be involved in piracy, but fails to discriminate between the true criminals and those who may have MP3 files they have created themselves," said Graham Cluley, senior technology consultant for Sophos. "Whichever side of the fence you come down on in regards to internet piracy, there's no debate about the criminal nature of this worm - designed to inflict malicious damage on people's Windows computers."

Internet pirates who have illegally distributed music files, movies and TV shows have been in the news recently as ISPs have been ordered in a number of cases to provide identitifying details of those individuals responsible so prosecutions can be brought against them. Last month, a Canadian man lost his job after it was found he had leaked the first episode of the eagerly anticipated BBC science fiction series "Doctor Who" onto the internet three weeks before its official broadcast.

Although there have only been a small reports of the worm, Sophos recommends computer users ensure their anti-virus software is up-to-date, and that companies protect themselves with a consolidated solution which can defend them from the threats of both spam and viruses.

More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at