What is Nava Shield?
The Malwarebytes research team has determined that Nava Shield is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue. You are strongly advised to follow our removal instructions below.
This one opens windows or tabs to porn sites to trick you into believing your computer is infected.
How do I know if I am infected with Nava Shield?
You will find these icons in your taskbar, on your desktop and in your Start-menu:
You may see this entry in your list of installed programs:
and see these warnings:
How did Nava Shield get on my computer?
Rogue programs use different methods for spreading themselves. This particular one was installed by a trojan.
How do I remove Nava Shield?
Our program Malwarebytes Anti-Malware can detect and remove this rogue.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes' Anti-Malware removes Nava Shield completely.
We hope our application has helped you eradicate this malicious software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes Anti-Malware for additional protection.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Nava Shield rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
Possible signs in FRST logs:
() C:\Nava Labs\Nava Shield\NavaShield.exe
() C:\Nava Labs\Nava Shield\NavaBridge.exe
() C:\Nava Labs\Nava Shield\NavaDebugger.exe
HKCU\...\Run: [NavaShield] => c:\Nava Labs\Nava Shield\navashield.exe [24966671 2015-11-30] ()
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1
C:\Nava Labs
Nava Shield 4.1 (HKLM-x32\...\Nava Shield 4.1) (Version: 4.1 - Nava Labs)
() C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll
() C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll
() C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll
() C:\Nava Labs\Nava Shield\NavaMod.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll
() C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll
() C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dllAlterations made by the installer:File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Nava Labs\Nava Shield
Adds the file analysis.dat"="9/24/2009 6:44 AM, 0 bytes, A
Adds the file bridge.dat"="3/8/2016 8:10 AM, 176 bytes, A
Adds the file config.dat"="3/8/2016 8:05 AM, 4356 bytes, A
Adds the file freeset.dat"="9/24/2009 6:44 AM, 125 bytes, A
Adds the file install.log"="9/24/2009 6:44 AM, 19 bytes, A
Adds the file NavaBridge.exe"="11/30/2015 5:01 PM, 4180383 bytes, A
Adds the file NavaDebugger.exe"="11/30/2015 5:01 PM, 10454951 bytes, A
Adds the file NavaMod.dll"="11/30/2015 5:01 PM, 5632 bytes, A
Adds the file NavaShield.exe"="11/30/2015 5:01 PM, 24966671 bytes, A
Adds the file navig.dat"="3/8/2016 8:07 AM, 255 bytes, A
Adds the file outlet.dat"="9/24/2009 6:44 AM, 0 bytes, A
Adds the file store.dat"="9/24/2009 6:44 AM, 4000 bytes, A
Adds the file Uninstall.ini"="3/8/2016 8:05 AM, 3840 bytes, A
Adds the file UninstallNava.exe"="3/8/2016 8:05 AM, 390696 bytes, A
Adds the folder C:\Nava Labs\Nava Shield\NavaBridge Libs
Adds the file Browser Plugin.dll"="11/30/2015 5:01 PM, 98304 bytes, A
Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A
Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
Adds the folder C:\Nava Labs\Nava Shield\NavaDebugger Libs
Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
Adds the folder C:\Nava Labs\Nava Shield\NavaShield Libs
Adds the file Appearance Pak.dll"="11/30/2015 5:01 PM, 139264 bytes, A
Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A
Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A
Adds the folder C:\Nava Labs\Nava Shield\NavaStorage
Adds the file nava.dat"="11/30/2015 5:01 PM, 160000 bytes, A
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu
Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1
Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 813 bytes, A
In the existing folder C:\Users\{username}\Desktop
Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 777 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nava Shield 4.1]
"DisplayIcon"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"
"DisplayName"="REG_SZ", "Nava Shield 4.1"
"DisplayVersion"="REG_SZ", "4.1"
"EstimatedSize"="REG_DWORD", 39878
"InstallDate"="REG_SZ", "20160308"
"InstallLocation"="REG_SZ", "c:\Nava Labs\Nava Shield\"
"InstallSource"="REG_SZ", "C:\Users\{username}1\AppData\Local\Temp\RarSFX0\"
"Language"="REG_DWORD", 1033
"NoModify"="REG_DWORD", 1
"NoRepair"="REG_DWORD", 1
"Publisher"="REG_SZ", "Nava Labs"
"UninstallString"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"
"URLInfoAbout"="REG_SZ", "http://www.navashield.com/"
"VersionMajor"="REG_DWORD", 4
"VersionMinor"="REG_DWORD", 1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"NavaShield"="REG_SZ", "c:\Nava Labs\Nava Shield\navashield.exe"Malwarebytes Anti-Malware log:Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 3/8/2016
Scan Time: 8:24 AM
Logfile: mbamNavaShield.txt
Administrator: Yes
Version: 2.2.0.1024
Malware Database: v2016.03.08.02
Rootkit Database: v2016.02.27.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 369053
Time Elapsed: 5 min, 35 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 3
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, 3440, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d]
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, 3132, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709]
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, 3140, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5]
Modules: 8
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Registry Keys: 1
Rogue.NavaShield, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Nava Shield 4.1, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Registry Values: 1
Rogue.NavaShield, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NavaShield, c:\Nava Labs\Nava Shield\navashield.exe, Quarantined, [e270e1a4bfda52e42dd7e0217c86d32d]
Registry Data: 0
(No malicious items detected)
Folders: 7
Rogue.NavaShield, C:\Nava Labs\Nava Shield, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72],
Files: 26
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5],
Rogue.NavaShield, C:\Users\{username}\Desktop\NavaShield.exe, Quarantined, [4c06384d9ffaa4928880eea0976bed13],
Rogue.NavaShield, C:\Users\{username}\Desktop\Nava Shield.lnk, Quarantined, [371b265f9405290d79c05af492719a66],
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk, Quarantined, [262c305519806accd9261b6219eb23dd],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\freeset.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\analysis.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\bridge.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\config.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\install.log, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\navig.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\outlet.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\store.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\Uninstall.ini, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\UninstallNava.exe, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage\nava.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c],
Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1\Nava Shield.lnk, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72],
Physical Sectors: 0
(No malicious items detected)
(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
