Re: trojan.narat

From: Aaron Bernstein (anonymous_at_discussions.microsoft.com)
Date: 01/01/04 

Date: Thu, 1 Jan 2004 13:12:04 -0800

AB,

Thank you. Worked like a charm. IE is back up and running
with no alerts.

Aaron...

>-----Original Message-----
>Aaron,
>
>To delete the file msnarrator.exe in the windows
directory, I had to boot up
>in safe mode and delete it.
>
>I made a modification to Ed's suggestion and created a 0
byte file named
>"msnarrator.exe" in the c:\windows directory and made it
read only. If the
>file wasn't read only, the virus would just delete the 0
byte file and
>Norton would repeatedly display the virus message.
>
>The virus is still here, but the message is no longer
appearing.
>
>AB
>
><anonymous@discussions.microsoft.com> wrote in message
>news:001101c3d095$373d3ad0$a501280a@phx.gbl...
>> Ed,
>>
>> How did you replace msnarrator.exe? It is not evident on
>> my PC.
>>
>> Aaron...
>>
>>
>> >-----Original Message-----
>> >Symantec has instructions on their site, but from what
>> I've seen in
>> >other groups it doesn't work all that well.
>> >Apparently, it's internet explorer itself that's infected.
>> Every time
>> >you browse to a web page, it re-installs msnarrator and
>> runs it.
>> >What's interesting is that if you open up "my computer"
>> and put a web
>> >address into the address bar, it does NOT run
msnarrator. I've
>> >defeated the trojan by replacing msnarrator with a
>> read-only program I
>> >Wrote that just logs that it ran and terminates. Whatever
>> it's using
>> >to reinstall msnarrator doesn't know to bypass a read-only
>> file
>> >
>> >"scott" <anonymous@discussions.microsoft.com> wrote in
>> message news:<03b601c3d032$f7b19b20$a401280a@phx.gbl>...
>> >> Hi
>> >>
>> >> Can anyone please let me know how to remove this and the
>> >> related file msnarrator.exe.
>> >>
>> >> it seems to open multiple Explorers?
>> >.
>> >
>
>
>.
>

Relevant Pages

  • Bobax.C
    ... Other files containing the virus have been ... W32.Bobax.C is a worm that exploits both the LSASS ... While this threat may execute on Windows 95/98/Me/Server ... Virus Definitions * ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Pixelsrvr.exe wont load on bootup
    ... Sounds like you got yourself a virus,. ... Adds the following line to the [windows] section of the Win.ini file: ... antivirus products, including the Symantec AntiVirus and Norton AntiVirus ... Disabling System Restore ...
    (microsoft.public.windowsxp.video)
  • Re: HELP ON XP RE-INSTALLATION...
    ... > IF I REINSTALL XP ON MY COMPUTER HELP IF I HAVE A VIRUS THAT I CANT ... Don't have an AntiVirus software? ... There are more applications you may need to run to completely clean your ... It will probably save you time and effort in re-installing Windows XP ...
    (microsoft.public.windowsxp.general)
  • Re: RE-INSTALLING XP
    ... > IF I REINSTALL XP ON MY COMPUTER HELP IF I HAVE A VIRUS THAT I CANT ... Don't have an AntiVirus software? ... There are more applications you may need to run to completely clean your ... It will probably save you time and effort in re-installing Windows XP ...
    (microsoft.public.windowsxp.general)
  • Re: Big Bertha Thing blogs
    ... Big Bertha Thing moisture ... but Windows is still down. ... It looks like I picked up a macro virus off a wordperfect attachment ... How can we hold this vision dearer than Thee. ...
    (sci.chem)