How do I totally remove Trojan.Narat from my computer?

[Andy Kiser]

My computer recently picked up the Trojan.Narat virus. I
went through Symantec.com (home of Norton AV), and
followed its recommended removal procedure. {The virus
came in attached to MSNarrator.exe}.

Anyway, even though I removed it - and subsequent scans
show my computer is "virus and Trojan free", a window
continues to pop up as I navigate websites. It
says, "Trojan.Narat detected. File deleted." My question
is this: how long am I going to have to deal with this,
if I've removed the virus/Trojan from my computer?

 

[Jupiter Jones [MVP]]

Andy;
Follow this to get rid of it:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.narat.html
Follow this to help prevent this and other issues in the future:
http://www3.telus.net/dandemar/Security.htm

 

[Ed Clark]

msnarrator.exe is not infected. It's a symptom of the infection--it's
not supposed to be there at all. Apparently, it's internet explorer
itself that's infected. Every time you browse to a web page, it
re-installs msnarrator and runs it. What's interesting is that if you
open up "my computer" and put a web address into the address bar, it
does NOT run msnarrator. I've defeated the trojan by replacing
msnarrator with a read-only program I Wrote that just logs that it ran
and terminates. Whatever it's using to reinstall msnarrator doesn't
know to bypass a read-only file

 

[L Verkeyn]

I too have received this trojan. Per Symantecs site, Norton was updated,
full system scan the files were found/deleted, regedit ran and list of
entries deleted.... but the problem is still there.
....
Ed, you said you replaced msnarrator with a read only program. NAV is
telling me msnarrator.exe is at E:/WINNT/msnarrator.exe but when I use
explorer to navigate there, the execute file does not exist.
any thoughts?
thanks.... btw.. even though I get the message pop-up from NAV when I use my
browser, telling me msnarrator was found/deleted, a full scan is free from
any infected files

 

[Jim Gnecco]

I have the same problem. Norton automatically deletes
the file but it just keeps coming back. I have to
repeatedly "OK" the Virus Alert which tells me the file
was deleted. This apparently repeats over and over.
Last time I OK'd the Alert I counted 157 repetitions of
the message.

Do you know what the msnarrator.exe file is?

I am about ready to spend the $35 to get MS help.

Let's share info on this one till we get it resolved.

Jim Gnecco
Newtown, PA
215-579-9189

 

[Jason]

Ok, its quite simple to get rid of this virus, just did it on a
friends computer. Obviously, from earlier posts, it attacks through
Interenet explorer and tries to install itself while you are interened
browsing. Well, after following norton's instructions on
www.symantec.com or just go the link that pops up whenever Norton
Antivirus finds this sucker. Thats step one, not removal like they
say, but disabling. It blocks the virus from reinstalling itself which
is good except that it is still going to try. As mentioned in another
post, a quick fix for that pop up is to open notepad and save a blank
document in C:/windows for Windows XP users, make sure to name it
msnarrator.exe and then once saved, browse to that folder and file,
right click, go to properties, and make it read only. Bam, virus can
no longer install itself. Problem is it is still there so lets see if
the Techs at symantec can find a way to remove the original host file.
It poses no threat but it annoying to know that it is there.

Some useful programs to search for or buy to prevent this is
Norton Interenet Secruity
Ad-Aware (a free ad remover, not blocker though)
Zone Alarm Pro (personal firewall, dont need it necessairly,
can get annoying but high security for the price)
Mcafee Protection (not as popular as Norton but still
effective)

If your virus persists i recommend reinstalling your OS, bit of a
hassel but if you are experienced or know someone who is computer savy
then this is the way to go to be sure you are rid of this. Id wait to
see if there is a better Norton patch to remove it though since it is
a (as of today) 2 day old virus.

If you need any further help post a reply with your email address and
i will try to contact you personally, Also an AIM Buddyname would be
more prominant.

 

[L Verkeyn]

Not a perfect solution, but it did work for me..... it is very similar to
the solution Jason gave, but I had done this one already....

Copied from a post By Robert Riley on another group

Quote.

I had all the same problems everyone else did. NAV would delete the
virus and it kept coming back.


There are two files that need to be renamed to get rid of it if you're
having this problem in Microsoft Internet Explorer.

Do a search on mpgcom in the C:\Windows\ directory. (Mine were actually in
\WINNT\ )
C:\Windows\mpgcom.dll
C:\Windows\Fonts\mpgcom

While all instances of Internet Explorer are closed down, rename those
two files to something like: mpgcom.dll_old and mpgcom_old

If you've done everything as described on the security web site
http://securityresponse.symantec.com/avcenter/venc/data/trojan.narat.html
and removed the entries using REGEDIT and had NAV clean out the virus,
renaming those two files should be the last step.

 

[Paul]

My computer recently picked up the Trojan.Narat virus. I
went through Symantec.com (home of Norton AV), and
followed its recommended removal procedure. {The virus
came in attached to MSNarrator.exe}.

Anyway, even though I removed it - and subsequent scans
show my computer is "virus and Trojan free", a window
continues to pop up as I navigate websites. It
says, "Trojan.Narat detected. File deleted." My question
is this: how long am I going to have to deal with this,
if I've removed the virus/Trojan from my computer?

Download and install Spybot-Search & Destroy 1.2 from
http://www.safer-networking.org/index.php?page=download
Download newest updates Dated Wednesday December 31, 2003
To see latest detection updated go to Help then About