Virus Question

[Starr Bullis]

Norton Antivirus program indentified a virus on my system ( Trojan.Narat ) .
Followed process to remove virus. Have scanned system numerous times since
and no virus is found.

When I use Internet Explorer to access the web a virus alert indicates that
the above virus is present on my computer. If I use MSN Explorer there is no
alert.

Calls to Symantec resulted in being referred to Gateway, Gateway in turn
referred me back to Symantec...HELP!!!!!

 

[TNS]

Did you follow the Symantec removal instructions? (disable sys
restore, etc?) It's lurking in the registry is my bet....It's going
to take some doing but good luck.

You might try this free scanner:
http://www3.enigmasoftwaregroup.com/download/spyhunterS.exe

I am trying it now Hmmm...

Keep us informed.

---TNS

 

[Starr Bullis]

I have follwed the Synmatecs instruction, there is no reference to this in
registry. Have reinstalled Microsoft Explorer and the alert still is present
when opening IE.

I hope this doesn't result in re-format of hard drive. YIKES!!!

 

[Gabriele Neukam]

On that special day, Starr Bullis, ([email protected]) said...

When I use Internet Explorer to access the web a virus alert indicates that
the above virus is present on my computer. If I use MSN Explorer there is no
alert.

Did you delete the temporary internet files? Perhaps it is reloaded from
there.

And if IE is so easily infected, why don't you switch to
Mozilla/Firebird or Opera, they can be used for free (Opera with a
little ad window), and aren't that vulnerable to these widespread
Windows Script Hosting / Jscript attacks.


Gabriele Neukam

(e-mail address removed)

 

[David H. Lipman]

From the Thread: trojan.narat
From the MS News Grou: microsoft.public.security.virus

~ ~ ~
In case you guys wanted to follow-up on removing the virus completely,
there are detailed instructions posted in other groups, but the short
of it is to find and delete the files iempg.dll, and mpgcom.dll in the
c:\windows or C:\winnt directory and mpgcom in c:\windows\fonts. You
don't have to reboot in safe mode. Just close all IE windows, then
Control/alt/delete to open the Task Manager and close the
msnarrator.exe process. Then delete the registry keys that norton
tells you to (hklm/software/microsoft/windows/currentversion/run/msnarrator.exe).
I'm doing this from memory but other groups have the details listed
better. Just search groups.google.com or use your newsreader search on
msnarrator. Tons of links available now. Cheers.

~ ~ ~
Dave




| Norton Antivirus program indentified a virus on my system ( Trojan.Narat ) .
| Followed process to remove virus. Have scanned system numerous times since
| and no virus is found.
|
| When I use Internet Explorer to access the web a virus alert indicates that
| the above virus is present on my computer. If I use MSN Explorer there is no
| alert.
|
| Calls to Symantec resulted in being referred to Gateway, Gateway in turn
| referred me back to Symantec...HELP!!!!!
|
|

 

[taff]

Norton Antivirus program indentified a virus on my system ( Trojan.Narat ) .
Followed process to remove virus. Have scanned system numerous times since
and no virus is found.

When I use Internet Explorer to access the web a virus alert indicates that
the above virus is present on my computer. If I use MSN Explorer there is no
alert.

Calls to Symantec resulted in being referred to Gateway, Gateway in turn
referred me back to Symantec...HELP!!!!!

Try this link first then follow the instructions below.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.narat.html

I had all the same problems everyone else did. NAV would delete the
virus and it kept coming back.

To alleviate that ACCESS DENIED error when trying to remove it, I
rebooted Windows in Safe Mode and then ran the virus scanner and
had it delete the file that way.

There are two files that need to be renamed to get rid of it if you're
having this problem in Microsoft Internet Explorer.

Do a search on mpgcom in the C:\Windows\ directory.
C:\Windows\mpgcom.dll
C:\Windows\Fonts\mpgcom

While all instances of Internet Explorer are closed down, rename those
two files to something like: mpgcom.dll_old and mpgcom_old

If you've done everything as described on the security web site and
removed the entries using REGEDIT and had NAV clean out the virus,
renaming those two files should be the last step.

These instructions are copied from another group and was originally
posted by Robert Riley. Further posts said that this works well.

Good luck

Taff..............



www.sounds-pa.com | www.thecomputerworkshop.com

 

[Netuser 58]

Take a look at the Symantec newsgroups. Type in the word Symantec in
your newsreader searchbox and you should see several of them.

Netuser 58

 

[David H. Lipman]

He's being helped right here. He doesn't need Symantec.

Dave



|
|
| Take a look at the Symantec newsgroups. Type in the word Symantec in
| your newsreader searchbox and you should see several of them.
|
| Netuser 58
|
|
| Starr Bullis wrote:
|
| > Calls to Symantec resulted in being referred to Gateway, Gateway in turn
| > referred me back to Symantec...HELP!!!!!
| >
| >
|