Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Nar.vbs Has Hit My System


  • Please log in to reply
5 replies to this topic

#1 captsparrow

captsparrow

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 11 December 2008 - 09:23 AM

I inserted a flash drive yesterday and soon popups from WinPatrol began to come up saying that 'nar.vbs' wanted to be added to startup programs. I canceled that, but continued. I finally searched through registry and managed to delete a few entries however, two entries had nar.vbs embedded in it and I didn't know how much to delete. I finally ran BitDefender's online scan, and it managed to detect the copies of the nar.vbs file on both drives, however, when I restarted the computer, the files are still on the both of the drives. I've tried searching for the files, and failed to find them, and the only anti-virus engine that found them was BitDefender.

Also, when I am in the My Computer window and attempt to go to one of my drives, a new window opens up containing the drive or no popup at all. If no drive window popups, another popup says 'Can not find script file "C:\nar.vbs". I've tried changing the settings under 'Folder Options' but no dice. Also, when I am on the desktop and try to visit one of the drives as well, a window popups saying 'Can not find script "C:\Documents and Settings\BRW\Desktop\nar.vbs'.

I've also run MBAM scans of the C drive as well as a quick scan and it has not detected anything.

I am not sure what this file is, but it is annoying.
Help would be greatly appreciated in removing this pest.

In addition the two reg entries modified are
C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe nar.vbs
C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe nar.vbs
under 'MountPoints2/Shell/Autorun/Command' under the Microsoft directory under CurrentUser

Edited by captsparrow, 11 December 2008 - 09:31 AM.


BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:12:30 AM

Posted 11 December 2008 - 02:20 PM

Please insert your flash drive before we begin!

Download Flash_Disinfector.exe by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that is plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 captsparrow

captsparrow
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 11 December 2008 - 06:00 PM

I ran the program from the desktop and restarted, however, upon restart I am still unable to click on the desktop icons to go to my drives on go to them from My Computer. Those reg entries are still modified as they were.

#4 captsparrow

captsparrow
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 11 December 2008 - 09:05 PM

I believe I managed to clean the nar.vbs files from my system using a tool called NarKiller, I found about at this site: http://www.techsupportforum.com/microsoft-...-c-nar-vbs.html

The shortcuts on the desktop are working again without any popups, and I can go to the drives through the My Computer window. If you need me to post any logs to verify this, just tell what I need to do.

#5 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:12:30 AM

Posted 11 December 2008 - 09:10 PM

So what problems are you still having?
---------------

Please reboot your computer and update Malwarebytes. This time do a FULL scan and post the new log here
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#6 captsparrow

captsparrow
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 11 December 2008 - 11:53 PM

I haven't found anything that was happening when nar.vbs was on my system. It appears to be working fine. I searched the registry and it didn't find anything.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users