Removal instructions for Nava Shield

[Metallica]

What is Nava Shield?

The Malwarebytes research team has determined that Nava Shield is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue. You are strongly advised to follow our removal instructions below.

This one opens windows or tabs to porn sites to trick you into believing your computer is infected.

How do I know if I am infected with Nava Shield?

You will find these icons in your taskbar, on your desktop and in your Start-menu:

You may see this entry in your list of installed programs:

and see these warnings:

How did Nava Shield get on my computer?

Rogue programs use different methods for spreading themselves. This particular one was installed by a trojan.

How do I remove Nava Shield?

Our program Malwarebytes Anti-Malware can detect and remove this rogue.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of Nava Shield?

• No, Malwarebytes' Anti-Malware removes Nava Shield completely.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application has helped you eradicate this malicious software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes Anti-Malware for additional protection.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Nava Shield rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Possible signs in FRST logs:

 () C:\Nava Labs\Nava Shield\NavaShield.exe () C:\Nava Labs\Nava Shield\NavaBridge.exe () C:\Nava Labs\Nava Shield\NavaDebugger.exe HKCU\...\Run: [NavaShield] => c:\Nava Labs\Nava Shield\navashield.exe [24966671 2015-11-30] () C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1 C:\Nava LabsNava Shield 4.1 (HKLM-x32\...\Nava Shield 4.1) (Version: 4.1 - Nava Labs)() C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll() C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll() C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll() C:\Nava Labs\Nava Shield\NavaMod.dll() C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll() C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll() C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll() C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll

Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Nava Labs\Nava Shield       Adds the file analysis.dat"="9/24/2009 6:44 AM, 0 bytes, A       Adds the file bridge.dat"="3/8/2016 8:10 AM, 176 bytes, A       Adds the file config.dat"="3/8/2016 8:05 AM, 4356 bytes, A       Adds the file freeset.dat"="9/24/2009 6:44 AM, 125 bytes, A       Adds the file install.log"="9/24/2009 6:44 AM, 19 bytes, A       Adds the file NavaBridge.exe"="11/30/2015 5:01 PM, 4180383 bytes, A       Adds the file NavaDebugger.exe"="11/30/2015 5:01 PM, 10454951 bytes, A       Adds the file NavaMod.dll"="11/30/2015 5:01 PM, 5632 bytes, A       Adds the file NavaShield.exe"="11/30/2015 5:01 PM, 24966671 bytes, A       Adds the file navig.dat"="3/8/2016 8:07 AM, 255 bytes, A       Adds the file outlet.dat"="9/24/2009 6:44 AM, 0 bytes, A       Adds the file store.dat"="9/24/2009 6:44 AM, 4000 bytes, A       Adds the file Uninstall.ini"="3/8/2016 8:05 AM, 3840 bytes, A       Adds the file UninstallNava.exe"="3/8/2016 8:05 AM, 390696 bytes, A    Adds the folder C:\Nava Labs\Nava Shield\NavaBridge Libs       Adds the file Browser Plugin.dll"="11/30/2015 5:01 PM, 98304 bytes, A       Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A    Adds the folder C:\Nava Labs\Nava Shield\NavaDebugger Libs       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A    Adds the folder C:\Nava Labs\Nava Shield\NavaShield Libs       Adds the file Appearance Pak.dll"="11/30/2015 5:01 PM, 139264 bytes, A       Adds the file Internet Encodings.dll"="11/30/2015 5:01 PM, 73728 bytes, A       Adds the file MD5.dll"="11/30/2015 5:01 PM, 94208 bytes, A    Adds the folder C:\Nava Labs\Nava Shield\NavaStorage       Adds the file nava.dat"="11/30/2015 5:01 PM, 160000 bytes, A    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 801 bytes, A    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 813 bytes, A    In the existing folder C:\Users\{username}\Desktop       Adds the file Nava Shield.lnk"="3/8/2016 8:05 AM, 777 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nava Shield 4.1]       "DisplayIcon"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"       "DisplayName"="REG_SZ", "Nava Shield 4.1"       "DisplayVersion"="REG_SZ", "4.1"       "EstimatedSize"="REG_DWORD", 39878       "InstallDate"="REG_SZ", "20160308"       "InstallLocation"="REG_SZ", "c:\Nava Labs\Nava Shield\"       "InstallSource"="REG_SZ", "C:\Users\{username}1\AppData\Local\Temp\RarSFX0\"       "Language"="REG_DWORD", 1033       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "Nava Labs"       "UninstallString"="REG_SZ", "c:\Nava Labs\Nava Shield\UninstallNava.exe"       "URLInfoAbout"="REG_SZ", "http://www.navashield.com/"       "VersionMajor"="REG_DWORD", 4       "VersionMinor"="REG_DWORD", 1    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]       "NavaShield"="REG_SZ", "c:\Nava Labs\Nava Shield\navashield.exe"

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 3/8/2016Scan Time: 8:24 AMLogfile: mbamNavaShield.txtAdministrator: YesVersion: 2.2.0.1024Malware Database: v2016.03.08.02Rootkit Database: v2016.02.27.01License: PremiumMalware Protection: DisabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 369053Time Elapsed: 5 min, 35 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 3Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, 3440, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d]Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, 3132, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709]Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, 3140, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5]Modules: 8Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Registry Keys: 1Rogue.NavaShield, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Nava Shield 4.1, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Registry Values: 1Rogue.NavaShield, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NavaShield, c:\Nava Labs\Nava Shield\navashield.exe, Quarantined, [e270e1a4bfda52e42dd7e0217c86d32d]Registry Data: 0(No malicious items detected)Folders: 7Rogue.NavaShield, C:\Nava Labs\Nava Shield, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72], Files: 26Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield.exe, Delete-on-Reboot, [e270e1a4bfda52e42dd7e0217c86d32d], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge.exe, Delete-on-Reboot, [aea48bfa3c5df93db64cde23ac56f709], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger.exe, Delete-on-Reboot, [1b37abdabcdd989e49ba44bd58aa2bd5], Rogue.NavaShield, C:\Users\{username}\Desktop\NavaShield.exe, Quarantined, [4c06384d9ffaa4928880eea0976bed13], Rogue.NavaShield, C:\Users\{username}\Desktop\Nava Shield.lnk, Quarantined, [371b265f9405290d79c05af492719a66], Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Nava Shield.lnk, Quarantined, [262c305519806accd9261b6219eb23dd], Rogue.NavaShield, C:\Nava Labs\Nava Shield\freeset.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\analysis.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\bridge.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\config.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\install.log, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaMod.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\navig.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\outlet.dat, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\store.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\Uninstall.ini, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\UninstallNava.exe, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Browser Plugin.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaBridge Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaDebugger Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Appearance Pak.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\Internet Encodings.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaShield Libs\MD5.dll, Delete-on-Reboot, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Nava Labs\Nava Shield\NavaStorage\nava.dat, Quarantined, [cc86067fc1d850e6cc34b9c5d034a45c], Rogue.NavaShield, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nava Shield 4.1\Nava Shield.lnk, Quarantined, [98ba1b6a6534d066ddfdb753f3108e72], Physical Sectors: 0(No malicious items detected)(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.