Parasite: NavExcel

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

NavExcel is a search hijacker implemented as an IE Browser Helper Object. Address bar searches, attempts to connect to unknown servers, and all 404 page-not-found errors (even those whose sites provide custom error pages) are redirected to webservicehost.com.

Also known as

NavHelper.

Distribution

Known to be bundled with CD-burning application burn4free, and screensavers from mvr.us. Also installed by the WildMedia parasite.

What it does

Advertising

No.

Privacy violation

No.

Security issues

Yes. NavExcel can download and execute arbitrary code from its controlling server www.navexcel.com (as an update feature).

Stability problems

Versions up to at least 2.0.4 of NavExcel (the latest at the time of writing) are incompatible with Windows XP Service Pack 2, and will cause both Internet Explorer and Windows Explorer (the main Window user interface) to crash every time they are started. Such a system will have to be rescued from Safe Mode or by using System Restore.

Removal

Go to Add/Remove Programs in the Control Panel, choose the ‘NavHelper’ entry, click ‘Remove’ and restart.

Links

Official NavExcel site

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!