ShopNav Description

ShopNav is a browser hijacker that modifies web browser essential search settings. It changes default search and error pages, alters address bar search options and affects user Internet experience. The threat redirects a web browser to ShopNav controlling servers. It also collects information about performed web searches and user system accounts and sends it to a predetermined remote server. ShopNav may download and install arbitrary applications and can silently update itself via the Internet. The threat is bundled with some parasites and advertising-supported products such as Grokster file sharing program. It automatically runs on every Windows startup.

Type: Browser Hijackers

How Can You Detect ShopNav?

ShopNav Technical Report

As new ShopNav details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following ShopNav files with its MD5s were created in the system:

ShopNav has typically the following processes in memory:

• srng.exe
• snhelper.dll
• srngutil.exe
• searchhook.dll
• enhtb.dll
• srnghelper.exe
• iehelper.dll
• extract.exe

ShopNav creates the following registry entries:

• SearchHook.SrchHook
• SearchHook.URLSearchHook.1
• SNHlprObj.SNHlprObj.1
• 0007522A-2297-43C1-8EB1-C90B0FF20DA5
• F08555A1-9CC3-11D2-AA8E-000000000000
• SearchHook.URLSearchHook
• SNHlprObj.SNHlprObj
• Srng
• CE7C3CF0-4B15-11D1-ABED-709549C10000
• SearchHook.SrchHook.1
• F08555B0-9CC3-11D2-AA8E-000000000000
• 14B3D246-6274-40B5-8D50-6C2ADE2AB29B
• C9C42510-9B21-41c1-9DCD-8382A2D07C61

Important Article Disclaimer