NavExcel install

[Chuck]

Hi, All.
I run MSAS on my Dell P4 WinXP SP2 PC. For about the past
three weeks, EVERY time I boot up, MSAS gives me a box
telling me that "The threat NavExcel browser search toolbar
is attempting to install. Do you want to remove?" So I say
yes, it says it's removing it, says it HAS removed it, and
I compute on my merry way. BUT...next time I log on, it's
the EXACT SAME THING! I've been to all the other forums,
followed all the advice I can find all over the web,
nothing works. The app seems not to be actually resident in
my machine; no spyware app detects it (other than this
thing), it's not listed in Add/Remove Programs as it would
be if installed, no registry entries that I can find. So
somewhere I guess there's a rogue installer I can't find.
Anybody have any ideas?
Thanks,
Chuck

 

[D@annyBoy]

you want to try running a full scan in safe mode?

--

D@nnyBoy
Have you tried posting your problems
not related to MS AntiSpyware to
news://msnews.microsoft.com

 

[plun]

I run MSAS on my Dell P4 WinXP SP2 PC. For about the past
three weeks, EVERY time I boot up, MSAS gives me a box
telling me that "The threat NavExcel browser search toolbar
is attempting to install.

Hi

To remove this I recommend you to also run Lavasofts Adaware
and to remove
all temporarily junk wich hides within your PC. All
scannings in safe mode.

Try to follow this:

- Download/Install CCleaner, www.ccleaner.com

- Download/Install Lavasofts Adaware

http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10319876.html?tag=list

* Also watch the video from Cnet about Adware within page
for best result.*

- Download Winsockfix, just a precaution if you loose your LSP.
http://www.tacktech.com/display.cfm?ttid=257

- Restart in *safe mode*, press F8 during reboot

- Run CCcleaner and remove all temporarily junk.

- Run Adaware, fullscan

- Run MSAS, fullscan

- Restart

- Please report back if it works.

 

[Chuck]

Will try. Already run AdAware, Sp[ybot and Spyware Blaster
in addition to MSAS. Will post. Off to work now (fun weekend!)

 

[plun]

Will try. Already run AdAware, Sp[ybot and Spyware Blaster
in addition to MSAS. Will post. Off to work now (fun weekend!)

Hi

Safe mode is important and also to remove all temporarily
files !

 

[Chuck]

Tried everything. Thought I had it too. Ran MSAS and AA in
Safe Mode. This time I made sure both ran the deepest scan
they have. MSAS found 7 instances of NavExcel (all in
Restore points, I believe [c:\system volume
information\_restore, etc]). Killed 'em all; no good. Same
^$#$^()& thing again! This time I figured well, if they
were in restore points, I'll turn off System Restore,
eliminate the saved points, maybe that'll do it. No dice.
When MSAS "removes" NE on bootup, it does say, "Removed
registry entry yadayada, but I can't find a way to make it
show me exactly what entry.
HEEEELLP!!

-----Original Message-----

Will try. Already run AdAware, Sp[ybot and Spyware Blaster
in addition to MSAS. Will post. Off to work now (fun

weekend!)

Hi

Safe mode is important and also to remove all temporarily
files !

 

[plun]

Tried everything. Thought I had it too. Ran MSAS and AA in
Safe Mode. This time I made sure both ran the deepest scan
they have. MSAS found 7 instances of NavExcel (all in
Restore points, I believe [c:\system volume
information\_restore, etc]). Killed 'em all; no good. Same
^$#$^()& thing again! This time I figured well, if they
were in restore points, I'll turn off System Restore,
eliminate the saved points, maybe that'll do it. No dice.
When MSAS "removes" NE on bootup, it does say, "Removed
registry entry yadayada, but I can't find a way to make it
show me exactly what entry.
HEEEELLP!!

Hi

Start MSAS and go to real time protection and choose "View
all events".

You can probably see what registry entry it is.

But I think its time for HijackThis and maybe Killbox.

http://www.aumha.org/a/quickfix.htm

Forum in step 7, it takes a minute to register.

 

[Chuck]

Tried that. All it tells me is that the user has decided to
remove the threat NavExcel Search Toolbar that has been
detected. It doesn't tell me what the entry was. I did a
registry search yesterday and found some entries for NE,
and nixed them, but it STILL does the same thing. Going
over the Real Time log, the two things that stand out as
having been done immediately prior to the issue were an
installation of a game by my wife (she has installed
several games from the same place before, and we haven't
had this problem) and the download of a QuickTime plugin in
mr Firefox.
I hvae tried HT-received no replies to my posts on the
forums for guys who can actually read those things. The log
seems to have ne reference to NE, anyway. Never heard of
Killbox. I'll give it a try. Thanks.

-----Original Message-----

Tried everything. Thought I had it too. Ran MSAS and AA in
Safe Mode. This time I made sure both ran the deepest scan
they have. MSAS found 7 instances of NavExcel (all in
Restore points, I believe [c:\system volume
information\_restore, etc]). Killed 'em all; no good. Same
^$#$^()& thing again! This time I figured well, if they
were in restore points, I'll turn off System Restore,
eliminate the saved points, maybe that'll do it. No dice.
When MSAS "removes" NE on bootup, it does say, "Removed
registry entry yadayada, but I can't find a way to make it
show me exactly what entry.
HEEEELLP!!

Hi

Start MSAS and go to real time protection and choose "View
all events".

You can probably see what registry entry it is.

But I think its time for HijackThis and maybe Killbox.

http://www.aumha.org/a/quickfix.htm

Forum in step 7, it takes a minute to register.

 

[plun]

I hvae tried HT-received no replies to my posts on the
forums for guys who can actually read those things. The log
seems to have ne reference to NE, anyway. Never heard of
Killbox. I'll give it a try. Thanks.

Well, they read it and answer when they have time, I
couldn´t find any messages unanswered and no one called
"Chuck"..... Follow what they advice you to do ie foreget
about Killbox.

A couple of them also writes answers from time to time
within this NG.

 

[plun]

Also try this:

Go to Add/Remove Programs in the Control Panel, choose the
'NavHelper' and click 'Remove'. Restart the computer