Windows Forum

Ask something
Discussion Locked

Trojan.Narat

0 helpful
11 replies

by tamj123 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

recently, everytime I open an internet webpages, Norton Realtime scan notifiy me it found a Trojan.Narat virus; file name: c:\WINNT\msnarrtor.exe; I deleted the file, modify the register, and reboot the computer. but, norton still tell me found Trojan.Narat Virus verytime i open any webages.

11 replies

by tamj123

I did follow the instructions, deleted the msnarrator.exe file and modify the registy, and I also did a full scan on my computer after restart, not virus found, BUT, verytime I open any and I MEAN ANY (yahoo, msn, google, symantec etc)website, the Norton will notifity me, it found Trojan.Narat virus.

Maybe this virus is too new, I only found information on symantec.com, not where else have any information on this virus.

by joseph moore

Try running HijackThis:
http://mjc1.com/mirror/hjt/

It will analyze IE and Netscape, and tell you exactly what settings (including browser plugins) that the web browsers are set to use. Perhaps this trojan is set in the browser as a BHO (browser helper object) to start when the browser opens.
With HijackThis, you can remove the very hidden REgistry settings that control this. HijackThis is a really good program to have for stuff weird web browser stuff like this!
A tutorial on HijackThis codes is here:
http://www.spywareinfo.com/~merijn/htlogtutorial.html

hope this helps

by joseph moore

Well, now that I have read on Trojan.Narat, I see it really doesn't do any browser plugin stuff! Oops! Guess I should read up on the virus before I open my big mouth!
Plus, it's New Years Eve, and I've had a few beers! My tech skills are, admittedly, a little impaired at this point!
But, the good thing is HijackThis also checks the Run portion of the Registry, and will tell you if this virus is still in there to autostart when Windows starts, and it will remove the Registry entry if you wish.

by joseph moore

Ah, yes, it IS a Browser Helper Object in IE, according to Symantec:
http://tinyurl.com/2sltw
So, you could use HijackThis to detect/remove it. One of the things HijackThis does is detect all BHOs that are plugged into IE, and gives you the option of removing their plugin to IE. It does NOT delete the files; it only removes their link to IE. So, the actual files would remain on your system using HijackThis, but they would not be called by IE anymore.

by w2ktechman

It may still have an infected file in IE. Try uninstalling IE then download and re-install it.
Another thing, delete all cookies, temp internet files, etc. It may be hiding in there.

by chris910

as of 3PM today Norton Added the following message to their site. "Please see the Adware.Mpgcom document for more information" unfortunately the link to adware.mpgcom seems to be broken.

I did some looking around on google and made the assumption that nortons "adware.mpgcom" was a reference to adware and the mpgcom toolbar.

If the instructions at this link seem to fit your situation you might give them a try. Here is the link that I found. http://www.kephyr.com/spywarescanner/library/mpgcomtoolbar/index.phtml

good luck!

by tamj123

chris,

I close the question by mistake, I will open other one, just submit the answer again.

This discussion is closed to new replies.