NOPIR.C Virus Page
I have written a small script to remove the virus that you can run at the safe mode command prompt. And another that you have to run in each users account.
This will automate the removal process somewhat. You will have to check to make sure that the virus is using the same filenames as the one I saw NOPIR.C
You will see the above message when the virus is running download and run this script to remove it.
Win32.nopir.c.p2p-worm-fix-v2.zip
ow to use
===========
Reboot in safe mode with command prompt. Press f8 for a menu while rebooting.
Login to your admin account.
Copy the files in this zip to your c: drive main root.
run the BAT file nopir-fix.bat
Some versions of this worm will mutate causing random filenames.
If the script thinks you have the mutating version it will try to
display the directory c:\Program Files\Restore\ If you see a ransom exe file
in this directory you must stop and manually delete it.
Once the script runs reboot normally. Everything should now be working.
You may have to reenable system restore. Select it from the programs menu.
Fixing other accounts.
======================
Rerun the script in each account by logging on and clicking on it.
Recovering deleted .com files.
==============================
You will need to recover your ntldr and ntdetect.com files. My system ran
without them but they say to recover them so here is how or you can check the
Microsoft website.
Boot up using your windows xp cd and select R. Login to the
recovery program. This is not DOS….
Be sure you are in your windows directory.
c:\windows
Find out your CD letter likely D
copy d:\i386\ntldr
copy d:\i386\ntdetect.com
exit and reboot.
====================================================================Final process is to do a full scan of your system using a virus scanner that can
detect this worm.
Extra copies of the virus might exist in temp files for each user the main temp
directory and all p2P sharing directories.
====================================================================
Recovering movie and music files.
All the files can be recovered because all the worm did is send the del command
and erased them from the directory. They are still on the drive and as long as
you recover them ASAP its likely you can get 99% of them back. The smaller your
drive is and the longer you wait the les likely it will be that you can recover
them.
Download one of the file recover programs and run it. You should see all of your
old files when it loads.
I tried Handy Recovery 2.0 And it worked fine.
====================================================================
Notes:
Stock exe and lnk files from dougknox.com. They have not been modified and will
be kept as and not be added to my main .reg import file.
If all of this works for you please post a thank you message on my downloads
page. And add a link to my site. Also if you find another bad reg key that needs
to be added to this tool let me know.
