Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Nava Shield

- - - - -

  • Please log in to reply
No replies to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 32,371 posts
Content is republished with permission from Malwarebytes.

What is Nava Shield?

The Malwarebytes research team has determined that Nava Shield is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue. You are strongly advised to follow our removal instructions below.
This one opens windows or tabs to porn sites to trick you into believing your computer is infected.

warning3.png

How do I know if I am infected with Nava Shield?

You will find these icons in your taskbar, on your desktop and in your Start-menu:

icons.png

You may see this entry in your list of installed programs:

warning5.png

and see these warnings:

warning1.png

warning2.png

warning4.png

warning6.png

How did Nava Shield get on my computer?

Rogue programs use different methods for spreading themselves. This particular one was installed by a trojan.

How do I remove Nava Shield?

Our program Malwarebytes Anti-Malware can detect and remove this rogue.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Nava Shield?
  • No, Malwarebytes' Anti-Malware removes Nava Shield completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application has helped you eradicate this malicious software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes Anti-Malware for additional protection.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Nava Shield rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.


protection1.png

Technical details for experts

Possible signs in FRST logs:

 () C:\Nava Labs\Nava Shield\NavaShield.exe
 () C:\Nava Labs\Nava Shield\NavaBridge.exe
 () C:\Nava Labs\Nava Shield\NavaDebugger.exe
 HKCU\...\Run: [NavaShield] => c:\Nava Labs\Nava Shield\navashield.exe [24966671 2015-11-30] ()
 C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk
 C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1
 C:\Nava Labs

Nava Shield 4.1 (HKLM-x32\...\Nava Shield 4.1) (Version: 4.1 - Nava Labs)
() C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll
() C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll
() C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll
() C:\Nava Labs\Nava Shield\NavaMod.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll
() C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Nava Labs\Nava Shield
       Adds the file analysis.dat"="9/24/2009 6:44 AM, 0 bytes, A
       Adds the file bridge.dat"="3/8/2016 8:10 AM, 176 bytes, A
       Adds the file config.dat"="3/8/2016 8:05 AM, 4356 bytes, A
       Adds the file freeset.dat"="9/24/2009 6:44 AM, 125 bytes, A
       Adds the file install.log"="9/24/2009 6:44 AM, 19 bytes, A
       Adds the file NavaBridge.exe"="11/30/2015 5:01 PM, 4180383 bytes, A
       Adds the file NavaDebugger.exe"="11/30/2015 5:01 PM, 10454951 bytes, A
       Adds the file NavaMod.dll"="11/30/2015 5:01 PM, 5632 bytes, A
       Adds the file NavaShield.exe"="11/30/2015 5:01 PM, 24966671 bytes, A
       Adds the file navig.dat"="3/8/2016 8:07 AM, 255 bytes, A
       Adds the file outlet.dat"="9/24/2009 6:44 AM, 0 bytes, A
       Adds the file store.dat"="9/24/2009 6:44 AM, 4000 bytes, A
       Adds the file Uninstall.ini"="3/8/2016 8:05 AM, 3840 bytes, A
       Adds the file UninstallNava.exe"="3/8/2016 8:05 AM, 390696 bytes, A
    Adds the folder C:\Nava Labs\Nava Shield\NavaBridge Libs
       Adds the file Browser Plugin.dll"="11/30/2015 5:01 PM, 98304 bytes, A
       Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A
       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
    Adds the folder C:\Nava Labs\Nava Shield\NavaDebugger Libs
       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
    Adds the folder C:\Nava Labs\Nava Shield\NavaShield Libs
       Adds the file Appearance Pak.dll"="11/30/2015 5:01 PM, 139264 bytes, A
       Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A
       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
    Adds the folder C:\Nava Labs\Nava Shield\NavaStorage
       Adds the file nava.dat"="11/30/2015 5:01 PM, 160000 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu
       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1
       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 813 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 777 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nava Shield 4.1]
       "DisplayIcon"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"
       "DisplayName"="REG_SZ", "Nava Shield 4.1"
       "DisplayVersion"="REG_SZ", "4.1"
       "EstimatedSize"="REG_DWORD", 39878
       "InstallDate"="REG_SZ", "20160308"
       "InstallLocation"="REG_SZ", "c:\Nava Labs\Nava Shield\"
       "InstallSource"="REG_SZ", "C:\Users\{username}1\AppData\Local\Temp\RarSFX0\"
       "Language"="REG_DWORD", 1033
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Nava Labs"
       "UninstallString"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"
       "URLInfoAbout"="REG_SZ", "http://www.navashield.com/"
       "VersionMajor"="REG_DWORD", 4
       "VersionMinor"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "NavaShield"="REG_SZ", "c:\Nava Labs\Nava Shield\navashield.exe"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/8/2016
Scan Time: 8:24 AM
Logfile: mbamNavaShield.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.03.08.02
Rootkit Database: v2016.02.27.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 369053
Time Elapsed: 5 min, 35 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 3
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, 3440, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d]
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, 3132, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709]
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, 3140, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5]

Modules: 8
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 

Registry Keys: 1
Rogue.NavaShield, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Nava Shield 4.1, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 

Registry Values: 1
Rogue.NavaShield, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NavaShield, c:\Nava Labs\Nava Shield\navashield.exe, Quarantined, [e270e1a4bfda52e42dd7e0217c86d32d]

Registry Data: 0
(No malicious items detected)

Folders: 7
Rogue.NavaShield, C:\Nava Labs\Nava Shield, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72], 

Files: 26
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5], 
Rogue.NavaShield, C:\Users\{username}\Desktop\NavaShield.exe, Quarantined, [4c06384d9ffaa4928880eea0976bed13], 
Rogue.NavaShield, C:\Users\{username}\Desktop\Nava Shield.lnk, Quarantined, [371b265f9405290d79c05af492719a66], 
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk, Quarantined, [262c305519806accd9261b6219eb23dd], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\freeset.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\analysis.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\bridge.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\config.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\install.log, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\navig.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\outlet.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\store.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\Uninstall.ini, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\UninstallNava.exe, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage\nava.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], 
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1\Nava Shield.lnk, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.