IExplore.exe starts itself, installs msnarrator.exe, SVCHOST 100% 1

[NigelKnowles]

On XP pro:

When IExplore is started, after a few minutes further copies start themselves and attempt to access the net. One copy of SVCHOST.exe goes to 90% plus.

When IExplore is started, or any access is made from it to the internet, the program msnarrator.exe is put into the registry, put into the startup, copied into the Windows directory and started. Deleting from all these places stops the imediate symptoms but it is installed again on the next access.

Norton (latest update 23rd Dec) and Stinger don't find anything. Can find no reference to msnarrator anywhere.

Have installed IExplore 6 SP1, and done a 'repair' but no effect.

Help!!!

 

[BeenThereDoneThat]

NigelKnowles:

Here is the Symantec write-up with removal instructions:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.narat.html

 

[NigelKnowles]

Thanks very much - the new virus files from Symantec (31st Dec) found the narat virus, I have deleted the entries from the registry and I don't now see the problem.

However, the msnarrator.exe file is only quarantined and it appears that the real root of the problem hasn't been found yet.

 

[Xemus]

Try an online Virus scan if your AV isn't catching everything.

http://www.closedsocket.com/links.html

http://www.closedsocket.com

 

[itzhari]

Hi all,

Even i have been infested by that trojan....
infact inspite of following the instructions(provided by Symantec) in detail for removing the trojan...it doesnt help much.

Infact the msnarrator.exe keeps reappearing (even though i have disabled System Restore) and of course Symantec keeps removing the corrupted file....i think it is keeping a trace of itself somewhere.
but isnt there a permanent solution to this problem?

Regards

 

[Xemus]

When does it reappear?
Download, run, and post a Hijack This log.

http://www.spywareinfo.com/~merijn/downloads.html

http://www.closedsocket.com

 

[NigelKnowles]

The new Symantec instructions seem to fix the problem, see

http://securityresponse.symantec.com/avcenter/venc/data/adware.mpgcom.html