Spyware or Virus??

[Dave]

My Norton Anti Virus just detected 3 threats and removed
them, they were all Adaware Navhelper files. The
curiosity is that according to Norton they are part of
Microsoft Spyware - so are they a virus or not?? The more
devices you have to prevent problems it seems the deeper
you can be drawn into virus/spyware paranoria. Help11

 

[Bill Sanderson]

What files were detected? Is there a log you can cut and paste from?

According to Symantec, the principle file involved in this threat is
nhelper.dll. This file is no part of Microsoft Antispyware.

Can you post any information about the files involved and their locations?
The program files storage locations can be written to by any
administrator--so trojans or viruses executed by the computer user (who may
well be an administrator) can be written to any location.

This is a trojan, so either the user at the time installed it, or installed
some piece of "freeware" which included this baggage.

 

[AndyManchesta]

Hi mate i think it might mean its bundled with products
for Microsoft Internet explorer

NavHelper is a small plug-in for MS Internet Explorer
which is developed by the UK company NavExcel

NavHelper is bundled with CD-Cover Editor. This means
that when you install CD-Cover Editor, you install
NavHelper too. However you can at any time uninstall
NavHelper from your system by using "add/remove programs"
in the "control panel".

Known to be bundled with CD-burning application
burn4free, and screensavers from mvr.us. Also installed
by the WildMedia parasite.

NavExcel can download and execute arbitrary code from its
controlling server www.navexcel.com (as an update
feature).

There's conflicting information on this some saying its
genuine others saying its adware but its listed on
symantecs site as adware so id tend to go with there view
of it

When Adware.NavHelper is installed, it creates several
registry keys in the Windows registry. Further,
Adware.NavHelper creates the folder, C:\Program
Files\NavExcel\NavHelper. All the files belonging to this
adware component will be inserted into this folder.

This adware component does not appear to track personally
identifiable information. But it does track the IP
address, and the search results may be affected by the
geographical location of the IP address

I dont think its worth me listing all the registry
entries as it appears it can be easily removed through
the Add/remove screen

Hope this helps

Andy