W32/Nopir-C

[hanswang]

It doesn't appear that the Avast Home (free) edition (auto updates in addition to frequent manual checks) currently installed on my system protects against the W32/Nopir-C worm.

It's a nasty virus/worm and I found a script someone has created and posted online for removal.  It's a bit more complicated to remove than other virii/worms I've encountered in the past and it's disturbing to know that a file I manually scanned appeared clean by Avast prior to executing.

Is this something that will be addressed at some point in the future?  I have had no previous problems with Avast and have recommended it to friends and colleagues because it is free and has received numerous positive reviews, but I just got burned bad and reluctantly I feel I must search for a replacement antivirus solution.

[polonus]

Hello hanswang,

As you can conclude from here: http://www.symantec.com/avcenter/venc/data/w32.nopir.c.html
w32.nopir is n't actually "climbing in through the window", just deliberately took some risks to get infected ( p2p-ring that is considered undesirable by some, and therefore accident prone).

Furthermore not a single AV solution can protect you against all malware around. It cannot be found on this planet. It is always a basic database with new definitions added, not a single solution carries the full spectrum. So this could have happened with another type of malware and another AV product as well.

I know this is not helping you, and I am not saying this in defense of the product at hand you trusted to secure you. Say that you were just unlucky in this case, on the other hand safe computer practices and pre-scanning with in-browser security (fileadvisor & DrWeb's pre-hyperlink scanner add-on) could have kept you free of this. "Don't take candy from strangers and surfing without admin rights" has saved many from malware. One ounce of protection is always better than several kilo's of cure.

polonus

[justin1278]

If you have a sample of this virus, submit it to virus@avast.com in a password protected .zip file. But this is not avast's fault in my opinion most Virus infections are the fault of the user, because of unresponsible internet downloading or browsing.

[DavidR]

Well avast only has one entry for win32:Nopir [Wrm] so I'm unsure if this is a generic signature that will detect the w32:Nopir family, probably not based on your statement.

If you still have a copy of it if you can zip and password protect ('virus', will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a new, undetected virus and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

What was it masquerading as to make you 1) want to download it, 2) want to execute it ?

No single AV solution is ever going to catch absolutely everything.

[hanswang]

Hey, thanks guys.  I'll send it out as soon as I get home and remedy the issue.  I appreciate the suggestions and feedback.

I was previously using Symantec's antivirus solution but when my subscription ran out I decided to try Avast! Home Edition.  The ironic thing is Symantec may have caught this worm while Avast did not.  I know not everything can be caught by any single solution, and I like Avast, so I'll simply have to exercise greater caution in the future.  It just stung knowing that this particular one slipped through after my transition from one solution to another.

[polonus]

Hi hanswang,

Thanks for your reply, satisfying feeling you could clean your OS from this malware. Welcome to our community, take notice of what we share in knowledge about securing computers from malware. Take the proper precautions, come back, and later you may be able to help out others with similar problems.

Stay safe, and run your machine secure,

polonus