Remove ShopNav. Description and removal instructions

 
Title: ShopNav

Type: Browser Hijackers
Severity scale:ShopNav severity is 43  (43 / 100)
 
ShopNav is a browser hijacker that modifies web browser's essential search settings. It changes default search and error pages, alters address bar search options and affects user Internet experience. The threat redirects a web browser to ShopNav controlling servers. It also collects information about performed web searches and user system account and sends it to a predetermined remote server. ShopNav may download and install arbitrary applications and can silently update itself via the Internet. The threat is bundled with some parasites and advertising-supported products such as Grokster file sharing program. It automatically runs on every Windows startup.


ShopNav properties:
• Changes browser settings
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic ShopNav removal:

remover for ShopNav

ShopNav manual removal:

Kill processes:
adrsb.exe, srng.exe, srngutil.exe, svchost.exe, waladhpr.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kugoo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srng
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst=[site address]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Search Assistant=[site address]
HKEY_CURRENT_USER\Microsoft\Internet Explorer\Main\Search Bar=[site address]
HKEY_CURRENT_USER\Microsoft\Internet Explorer\Main\Search Page=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\Search Assistant=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\provider=msn
HKEY_CURRENT_USER\Software\Microsoft\SearchAssistant\DefaultSearchURL=[site address]
HKEY_CURRENT_USER\Software\Srng
HKEY_LOCAL_MACHINE\SOFTAWRE\Kugoo
HKEY_LOCAL_MACHINE\SOFTWARE\Srng
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PCID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SNHlprObj.SNHlprObj
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14B3D246-6274-40B5-8D50-6C2ADE2AB29B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{14B3D246-6274-40B5-8D50-6C2ADE2AB29B}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{14B3D246-6274-40B5-8D50-6C2ADE2AB29B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shnv
Unregister DLLs:
iehelper.dll, iehelper02.dll, searchhook.dll, snhelper.dll

Delete files:
adrsb.exe, srng.exe, srngutil.exe, svchost.exe, waladhpr.exe, iehelper.dll, iehelper02.dll, searchhook.dll, snhelper.dll, ieshnv.ini
Delete directories:
C:\Program Files\Kugoo
C:\Program Files\Snrg
Misc:
[site address] is an address of a web site on the 2020search.com or pop.popuptoast.com domain.

Exact file location:
adrsb.exe, svchost.exe, waladhpr.exe - C:\Windows or C:\Winnt
srng.exe, srngutil.exe, iehelper.dll, iehelper02.dll, searchhook.dll, snhelper.dll - C:\Program Files\Srng or C:\Program Files\Kugoo
ieshnv.ini - C:\Program Files

Other programs to remove ShopNav:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 19/03/04
Information updated: 03/09/05

Additional resources related to ShopNav:

Attention: If you know or you have a website or page about ShopNav removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about ShopNav parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:


Comments from visitors:


1. spy blockers by Guest. 2005-05-06 12:05:00
I want it remove off my computer please.

2. Successfully remove ShopNav by Guest. 2004-12-17 12:12:41
There is an additional website that you can go to to remove ShopNav, http://shopnav.com/support.html. There are instruction for removing the Desktop Search Assistant as well as resetting the IE search buttons. Make sure you do both b/c only doing one will not repair the IE search buttons completely. Best of luck!
~ thebigd18

3. shop nav by Guest. 2004-12-07 19:12:15
I agree with Sanjay, but a little less violently.
It is extremely annoying to see shopnav keep popping up, time and time again, after successful removal. Yes, there should be extreme punishment, but rather than hanging, I think financial punishment and imprisonment would be more appropriate! I would claim that removing shop nav has cost me at least 4 hours of my life and would like to see if anyone would like to start a class action lawsuit against the shitheads who do this to us!
Use "Adaware". It is free and very good!

4. HijackThis Worked the best by Guest. 2004-11-16 02:11:19
I tried everything above, what a mess.I lost a whole days work over shopnav and xlime.optimizer which I got a the same time. Hijackthis even restored my search values. Yaaaaaa!!!!!

5. Microsoft recomends this spyware removal software by Guest. 2004-11-05 06:11:11
Microsoft recommends this free adware software removal, ( lavasoftusa.com ). I used it and it found 36. I deleted all but 6 or 7, the info said that they where part of Internet Explorer.

Then I tried a search using address bar where URL link is. I typed in " toy collecting " the address bar & clicked enter key, and I got the "cannot find" page. Before I would get the Shopnav search engine. So Now What?????

I went to Microsoft.com and searched for an answer to repair my Internet Explorer 6 Service Pack 1. And I found it at this link. " http://support.microsoft.com/default.aspx?scid=kb;en-us;318378 ".

I scrolled down the page to " Windows XP and Windows XP SP1: Edit the registry and install Internet Explorer 6 ". When you are modifying your registry, be SURE TO FOLLOW exact instructions....

If this works. I will come right back and post.

Tks for this site
CJSmall
Indiana

6. Fix by Guest. 2004-11-04 13:11:51
Just download that SpyHunter software, scan your drives and MANUALLY delete every friggn thing it finds!

:)

Link to download is up at the top of this page, etc:

ShopNav automatic removal:

download removal software



Yeah I hate this ShopNav. Pretty pointless software..

7. How to use DOS command prompt in Removal of Shopnav by Guest. 2004-11-04 01:11:28
I am not a PC whiz. Will someone explain exactly what I am to type in on command prompt. I have XP home edition, and when I go to DOS command prompt. What exactly am I supposed to type in after " c:Documents and Settinguser name "


Below is part of the instructions I do not really totally understand....

Next, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands, for the IE variant:

cd "%WinDir%System"
regsvr32 /u "Program FilesSrngSearchHook.dll"
regsvr32 /u "Program FilesSrngIEHelper.dll"
Or for the SN variant:

cd "%WinDir%System"
regsvr32 /u "Program FilesSrngSNHelper.dll"

8. Internet Fraud Complaint File a FCC complaint here by Guest. 2004-11-03 21:11:22
Go to this link, its where you can file a complaint with the FCC on Shopnav.

Just copy/paste this link

http://www.ifccfbi.gov/index.asp

9. Find your state Attorneys Link here, to file a complaint by Guest. 2004-11-03 21:11:12
Go to this site to find your state attorneys office link...Then make a camplaint



http://www.mbecellular.com/state.html



Underneath your address line, click MSN.com and copy/paste this address. This will let you search on MSN browser and block Shopnav

10. by Guest. 2004-10-23 07:10:59
Thank you sooo much for this website.
I had removed and fixed everything but still had one more fill other websited failed to mention:
systb.dll and after doing a search found :
systb with a red icon= the actual program that kept changing browser setting upon startup of windows!! Thanks again

11. Shop Nav by Guest. 2004-10-05 16:10:51
In my case it seems to be the cookies .If you have Windows XP there is a very simple way to stop this. When this shit appears copy the Address from your browser under the edit tab , enable internet properties , select "privacy " , then click on "sites" paste the name of this web site in the adress box and select "block" . Shut down . This has worked for me .

12. Shopnav is HISTORY by Guest. 2004-10-03 16:10:54
In regards to #58.. deleting the file "systb.dll" does work. I tried it, the first time, I also had trouble deleting the file. It said "cannot delete.. may be in use.." blah blah blah... just get off the internet and then try again.. if that fails, restart your computer. Make sure the first thing you do before you start up anything else to go and delete that file. I did and it works! I got my default msn search engine back. I missed it so much, can't explain how wonderful i felt when shopnav didnt pop up. =D good luck to u all!!

13. Successfully removed shop Nav by Guest. 2004-09-26 13:09:54
In frustration as to trying everything to get rid of this monster, I typed in www.shopnav.com in my address bar and found the removal tool. there was a weird type of code password you needed to retype but after several attempts i got it correctly and was able to remove the bug.

14. Help by Guest. 2004-09-12 14:09:51
I found the file "Systb.dll" But it will not allow me to delet it. What do I do?

15. Eased my Pain by Guest. 2004-09-12 00:09:18
Removing the SYSTB.DLL file referenced in post #49 worked for me!

16. FrenchCanadianInNewMexico by Guest. 2004-08-28 16:08:40
Out of frustration I found this site. ShopNav is really starting to make not just computer using a pain, but in turn making life for me very difficult. I'm seriously thinking about finding a cause of action..ANY...such as harassment or intentional infliction of emotional distress...to use in federal court. I am unable to access online classes or my bank account from home. All we need is one legal precedent and all of this BS will be over.

17. lucifer is shopNav by Guest. 2004-08-27 12:08:37
i think lucifer is shopNav....i kid you not..insane?yes it is driving me insane....shopNav makes computing sheer hell....shopNav is hell...
lawsuits? yes i want to jump on that class action suit...i agree with ALL the above negative posts..
we are being raped by this thing....this should be outlawed like in the days of old when laws meant something!

madddddddd....how about...-------- fill in blanks!

18. per IT WORKS!!! by Guest. 2004-08-25 13:08:35
Those instructions did work AND they are easy to do. You DON'T want to mess up any of the reg. keys, but if you do EXACTLY what those directions say, SHOPNAV is history!

19. IT WORKS!!! by Guest. 2004-08-25 13:08:36
THIS WORKED FOR ME

The following instructions are from: http://www.doxdesk.com/parasite/ShopNav.html

SHOPNAV REMOVAL
Open the registry (click 'Start', choose 'Run', and type 'regedit'), and find the key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun. In the list of values on the right, delete the 'srng' entry.

Next, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands, for the IE variant:

cd "%WinDir%System"
regsvr32 /u "Program FilesSrngSearchHook.dll"
regsvr32 /u "Program FilesSrngIEHelper.dll"
Or for the SN variant:

cd "%WinDir%System"
regsvr32 /u "Program FilesSrngSNHelper.dll"
Restart the machine and you should be able to delete the 'Srng' folder inside the Program Files folder. You can also open the registry (Start->Run->regedit) and delete key HKEY_LOCAL_MACHINESOFTWARESrng, and delete the 'words.lst' file in the Windows folder to clean up if you like.

Finally, restore the normal search settings (Internet Options->Programs->Reset Web Settings).

20. Shopnav sucks!!!!!!! by Guest. 2004-08-20 14:08:56
I am having the same problem as Peter in #21 post. I am so pissed off right now, I can't even think to do my work. Shopnav has rendered websites I use everyday unusable. It makes me furious that these bastards can install shit on my computer without my permission or knowledge. This is my personal property and they have no right to touch it. I have tried everything to uninstall this crap and nothing works. I have also emailed complaints to Shopnav with no avail. Good for your #51 for taking these assholes to court! I hope you are successful and shut them down!
Where can I complain about this in a formal and effective manner? Anyone know?
I share all of your pain!!!

See more comments about ShopNav >>>
Related news:
Similar parasites:
Related articles: