TROJ_NAVHELPER.A

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>'WE' Group
3. Still in the left panel, locate and delete the key:
   ProxyChecker
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   'WE' Group ProxyChecker
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>NavExcel
7. Still in the left panel, locate and delete the key:
   NavHelper
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>NavExcel>NavHelper
9. Still in the left panel, locate and delete the key:
   INSTALLING
10. Again Still in the left panel, locate and delete the key:
    v2.0.4a
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
12. Still in the left panel, locate and delete the key:
    {710BCB5B-8C6C-483E-A4F5-FAF083B13184}
13. Again Still in the left panel, locate and delete the key:
    NHelper.DLL
14. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
15. Still in the left panel, locate and delete the key:
    NavExcel.NavHelper.1
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NavExcel.NavHelper.1
17. Still in the left panel, locate and delete the key:
    CLSID
18. Again Still in the left panel, locate and delete the key:
    NavExcel.NavHelper
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NavExcel.NavHelper
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    CurVer
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
23. Still in the left panel, locate and delete the key:
    {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
25. Still in the left panel, locate and delete the key:
    ProgID
26. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
27. Again Still in the left panel, locate and delete the key:
    Programmable
28. Again Still in the left panel, locate and delete the key:
    InprocServer32
29. Again Still in the left panel, locate and delete the key:
    TypeLib
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
31. Still in the left panel, locate and delete the key:
    {FA4DE133-D3C3-4ED4-92D1-CD4DDE839AB3}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FA4DE133-D3C3-4ED4-92D1-CD4DDE839AB3}
33. Still in the left panel, locate and delete the key:
    1.0
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FA4DE133-D3C3-4ED4-92D1-CD4DDE839AB3}>1.0
35. Still in the left panel, locate and delete the key:
    FLAGS
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FA4DE133-D3C3-4ED4-92D1-CD4DDE839AB3}>1.0>0
37. Still in the left panel, locate and delete the key:
    win32
38. Again Still in the left panel, locate and delete the key:
    HELPDIR
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
40. Still in the left panel, locate and delete the key:
    {20F36AF3-3486-4BB6-8BCB-F1F8ABE74D07}
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{20F36AF3-3486-4BB6-8BCB-F1F8ABE74D07}
42. Still in the left panel, locate and delete the key:
    ProxyStubClsid
43. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
44. Again Still in the left panel, locate and delete the key:
    TypeLib
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
46. Still in the left panel, locate and delete the key:
    NavHelper
47. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>'WE' Group>ProxyChecker
3. In the right panel, locate and delete the entry:
   InstallPath = "%Program Files%\ProxyChecker"
4. Again In the right panel, locate and delete the entry:
   Start Menu Folder = "'WE' Group ProxyChecker"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>'WE' Group ProxyChecker
6. In the right panel, locate and delete the entry:
   DisplayName = "'WE' Group ProxyChecker"
7. Again In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\ProxyChecker\Uninstall.exe"
8. Again In the right panel, locate and delete the entry:
   DisplayIcon = "%Program Files%\ProxyChecker\ProxyChecker.exe"
9. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
10. In the right panel, locate and delete the entry:
    CLSID\{8FE54D14-E292-4023-7C99-FCF094DD0F40} = "Hasolik Soxasi"
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER
12. In the right panel, locate and delete the entry:
    Software\ASProtect\SpecData = "326E2AEA326E2AEA"
13. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>ASProtect>SpecData
14. In the right panel, locate and delete the entry:
    326E2AEA326E2AEA = "{random values}"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>NavExcel>NavHelper
16. In the right panel, locate and delete the entry:
    Source = "20040517bb"
17. Again In the right panel, locate and delete the entry:
    Current Version = "offline"
18. Again In the right panel, locate and delete the entry:
    InstallPath = "%User Temp%\NavInst"
19. Again In the right panel, locate and delete the entry:
    Install Version = "v2.0.4a"
20. Again In the right panel, locate and delete the entry:
    FolderPath = "%Program Files%"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>NavExcel>NavHelper>v2.0.4a
22. In the right panel, locate and delete the entry:
    v2.0.4a.cab = "v2.0.4a.cab"
23. Again In the right panel, locate and delete the entry:
    NHUpdater.exe = "NHUpdater.exe"
24. Again In the right panel, locate and delete the entry:
    NHUninstaller.exe = "NHUninstaller.exe"
25. Again In the right panel, locate and delete the entry:
    NHelper.htm = "NHelper.htm"
26. Again In the right panel, locate and delete the entry:
    NHelper.dll = "NHelper.dll"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>NHelper.DLL
28. In the right panel, locate and delete the entry:
    AppID = "{710BCB5B-8C6C-483E-A4F5-FAF083B13184}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}>InprocServer32
30. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
32. In the right panel, locate and delete the entry:
    AppID = "{710BCB5B-8C6C-483E-A4F5-FAF083B13184}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{20F36AF3-3486-4BB6-8BCB-F1F8ABE74D07}>TypeLib
34. In the right panel, locate and delete the entry:
    Version = "1.0"
35. Again In the right panel, locate and delete the entry:
    CLSID = "{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>NavHelper
37. In the right panel, locate and delete the entry:
    DisplayName = "NavHelper"
38. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\NavExcel\NavHelper\v2.0.4a\NHUninstaller.exe"
39. Again In the right panel, locate and delete the entry:
    HelpLink = "http://www.{BLOCKED}el.com/faqs.html"
40. Again In the right panel, locate and delete the entry:
    Update = "2000-04-05 12:00:00 AM"
41. Again In the right panel, locate and delete the entry:
    Current Version = "v2.0.4a"
42. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsf3.tmp
   • %User Temp%\nsf5.tmp\splash.bmp
   • %User Temp%\nsf5.tmp\advsplash.dll
   • %User Temp%\nsf5.tmp\ioSpecial.ini
   • %User Temp%\nsf5.tmp\modern-wizard.bmp
   • %User Temp%\nsf5.tmp\modern-header.bmp
   • %User Temp%\nsf5.tmp\InstallOptions.dll
   • %User Temp%\nsf5.tmp\StartMenu.dll
   • %Program Files%\ProxyChecker\proxychecker.exe
   • %Program Files%\ProxyChecker\ProxyCheckerHelp.chm
   • %Program Files%\ProxyChecker\Newsletter.url
   • %Program Files%\ProxyChecker\ColorTetris.ico
   • %Program Files%\ProxyChecker\ColorTetris.url
   • %Program Files%\ProxyChecker\Brickliner.ico
   • %Program Files%\ProxyChecker\Brickliner.url
   • %Program Files%\ProxyChecker\Krakout.ico
   • %Program Files%\ProxyChecker\Krakout.url
   • %Program Files%\ProxyChecker\KrakoutRE.ico
   • %Program Files%\ProxyChecker\KrakoutRE.url
   • %Program Files%\ProxyChecker\OpenIt.ico
   • %Program Files%\ProxyChecker\OpenIt.url
   • %Program Files%\ProxyChecker\Uninstall.exe
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Free Online Registration.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Home Page.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Help.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Subscribe to News.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\ColorTetris.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Brickliner.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Krakout.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Krakout RE.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\OpenIt.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Uninstall ProxyChecker.lnk
   • %User Temp%\NavInst\NHInstall.exe
   • %User Temp%\NavInst\NHManifest.txt
   • %User Temp%\NavInst\v2.0.4a.cab
   • %Program Files%\NavExcel\NavHelper\v2.0.4a\v2.0.4a.cab
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsf3.tmp
   • %User Temp%\nsf5.tmp\splash.bmp
   • %User Temp%\nsf5.tmp\advsplash.dll
   • %User Temp%\nsf5.tmp\ioSpecial.ini
   • %User Temp%\nsf5.tmp\modern-wizard.bmp
   • %User Temp%\nsf5.tmp\modern-header.bmp
   • %User Temp%\nsf5.tmp\InstallOptions.dll
   • %User Temp%\nsf5.tmp\StartMenu.dll
   • %Program Files%\ProxyChecker\proxychecker.exe
   • %Program Files%\ProxyChecker\ProxyCheckerHelp.chm
   • %Program Files%\ProxyChecker\Newsletter.url
   • %Program Files%\ProxyChecker\ColorTetris.ico
   • %Program Files%\ProxyChecker\ColorTetris.url
   • %Program Files%\ProxyChecker\Brickliner.ico
   • %Program Files%\ProxyChecker\Brickliner.url
   • %Program Files%\ProxyChecker\Krakout.ico
   • %Program Files%\ProxyChecker\Krakout.url
   • %Program Files%\ProxyChecker\KrakoutRE.ico
   • %Program Files%\ProxyChecker\KrakoutRE.url
   • %Program Files%\ProxyChecker\OpenIt.ico
   • %Program Files%\ProxyChecker\OpenIt.url
   • %Program Files%\ProxyChecker\Uninstall.exe
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Free Online Registration.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Home Page.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\ProxyChecker Help.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Subscribe to News.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\ColorTetris.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Brickliner.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Krakout.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\Krakout RE.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links\OpenIt.lnk
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Uninstall ProxyChecker.lnk
   • %User Temp%\NavInst\NHInstall.exe
   • %User Temp%\NavInst\NHManifest.txt
   • %User Temp%\NavInst\v2.0.4a.cab
   • %Program Files%\NavExcel\NavHelper\v2.0.4a\v2.0.4a.cab
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\nsf5.tmp
   • %Program Files%\ProxyChecker
   • %Start Menu%\Programs\'WE' Group ProxyChecker
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links
   • %User Temp%\NavInst
   • %Program Files%\NavExcel
   • %Program Files%\NavExcel\NavHelper
   • %Program Files%\NavExcel\NavHelper\v2.0.4a
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\nsf5.tmp
   • %Program Files%\ProxyChecker
   • %Start Menu%\Programs\'WE' Group ProxyChecker
   • %Start Menu%\Programs\'WE' Group ProxyChecker\Links
   • %User Temp%\NavInst
   • %Program Files%\NavExcel
   • %Program Files%\NavExcel\NavHelper
   • %Program Files%\NavExcel\NavHelper\v2.0.4a