NavaShield

NavaShield was a rogue security application which attempted to scare users into purchasing a license. NavaShield can be noted for its aggressive tactics compared to similar scams, which gives the term "scareware" a whole new meaning. Originally when it was installed it would claim the user's computer was "protected", however, once the trial period ended NavaShield would wreak havoc. NavaShield would simulate an actual malware infection rather than simply blocking programs stating they cannot run due to infection, or displaying fake alerts. Its payload is characterized by playing obnoxious laughing and threats through the speaker, opening pornographic websites, sending emails to fake e-mail addresses (usually with names such as "beb@sexsex"), and opening random explorer windows. Its alternative payload is running a fake format of your disk drive (and preventing application execution in the process), at the same time rapidly playing Internet Explorer's "Popup Blocked" sound ad infinitum.

NavaShield has two different payloads:

1. The first and most common payload consists of warnings for non-existent malware infections, as well as pop-ups of porn sites. When this happens, it will also play a laughing sound ad infinitum.^[1]
2. The second, less common payload has a pop-up reading "Disk drive C: is being deleted" appearing and expanding to eventually fill the entire screen, accompanied by Internet Explorer's 'Pop-up Blocked' sound repeated ad infinitum^[2] . When it has filled the screen and the bar is finally full, the fake pop-up disappears and shows only the wallpaper, with NavaShield blocking the task manager, rendering the computer useless unless rebooted.

In normal environment,NavaShield may block any anti-virus software that attempts to execute on the system,so to remove it you must boot into Safe Mode with Networking to use anti-virus to remove it. Instructions at http://www.wikihow.com/Remove-Navashield

1. ^ "Nava Shield". http://www.youtube.com/watch?v=0hxFyDpfcg0. 
2. ^ "NavaShield is back". http://www.youtube.com/watch?v=C7IJHoxcNr8.