Noped

Classification

Malware

Worm

VBS

Noped

Summary

VBS/Noped is encrypted and polymorphic worm written in Visual Basic Script.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Variant:Noped.A

This worm arrives is a message that have the following content:

Subject:

FWD: Help us ALL to END ILLEGAL child porn NOW

 Body: Hi, just a quick email. Please read the attached document as soon as you can.

 Thanks.

 Attachment: END ILLEGAL child porn NOW.TXT............vbe

or in a message that have a completely random subject, body and attachment name.

When executed, the worm shows the following text in Notepad:

--- Begin Worm Message ------------------------------------------

In 1977 the Sexual Exploitation of Children Act (18 U.S.C.

 2251-2253) was enacted. The law prohibits the use of a minor in

 the making of pornography, the transport of a child across state

 lines, the taking of a pornographic picture of a minor, and the

 production and circulation of materials advertising child

 pornography. It also prohibits the transfer, sale, purchase, and

 receipt of minors when the purpose of such transfer, sale,

 purchase, or receipt is to use the child or youth in the

 production of child pornography. The transportation, importation,

 shipment, and receipt of child pornography by any interstate

 means, including by mail or computer, is also prohibited

 The Child Protection Act of 1984 (18 U.S.C. 2251-2255) defines

 anyone younger than the age of 18 as a child. Therefore, a

 sexually explicit photograph of anyone 17 years of age or younger

 is child pornography.

 On November 7, 1986, the U.S. Congress enacted the Child Sexual

 Abuse and Pornography Act (18 U.S.C. 2251-2256), that banned the

 production and use of advertisements for child pornography and

 included a provision for civil remedies of personal injuries

 suffered by a minor who is a victim. It also raised the minimum

 sentences for repeat offenders from imprisonment of not less than

 two years to imprisonment of not less than five years.

 On November 18, 1988, the U.S. Congress enacted the Child

 Protection and Obscenity Enforcement Act (18 U.S.C. 2251-2256)

 that made it unlawful to use a computer to transmit advertisements

 for or visual depictions of child pornography and it prohibited

 the buying, selling, or otherwise obtaining temporary custody or

 control of children for the purpose of producing child

 pornography.

 On November 29, 1990, the U.S. Congress enacted 18 U.S.C. 2252

 making it a federal crime to possess three or more depictions of

 child pornography that were mailed or shipped in interstate or

 foreign commerce or that were produced using materials that were

 mailed or shipped by any means, including by computer.

 With the passage of the Telecommunications Act of 1996, (18 U.S.C.

 2422) it is a federal crime for anyone using the mail, interstate

 or foreign commerce, to persuade, induce, or entice any individual

 younger than the age of 18 to engage in any sexual act for which

 the person may be criminally prosecuted.

 The Child Pornography Prevention Act of 1996 amends the definition

 of child pornography to include that which actually depicts the

 sexual conduct of real minor children and that which appears to be

 a depiction of a minor engaging in sexual conduct. Computer,

 photographic, and photocopy technology is amazingly competent at

 creating and altering images that have been 'morphed' to look like

 children even though those photographed may have actually been

 adults. People who alter pornographic images to look like children

 can now be prosecuted under the law.

--- End Worm Message --------------------------------------------

The worm changes also the Internet Explorer title bar text to:

|.,.-*^*-.,.\ FUAHACKEDU@888.NU /.,.-*^*-.,.|

Next the worm sends itself within above mentioned messages to random number of recipients listed in the Outlook address book. This worm also collects a list of files with extension ".jpg" or ".jpeg" and sends this list to several fixed email addresses.