I found this while looking up information in this thread : /t171447-Browser_hijack_by_navil_com.html .

It appears to be a borderline toolbar but because there is evidence that some kind of exploit is being used to direct users to navil.com , I would consider this malware by default . The toolbar does not appear to be directly related to the redirect , not on my system at least .

Link_Comp.ocx
NavilToolbar.dll
Setup.exe
ToolbarInstaller.exe

These four all scan clean .


STATUS: FINISHEDComplete scanning result of "IFinst27.exe", received in VirusTotal at 11.10.2006, 15:37:40 (CET).

Authentium 4.93.8 11.10.2006 W32/Downloader.AOLK
Fortinet 2.82.0.0 11.10.2006 suspicious
F-Prot 3.16f 11.10.2006 security risk named W32/Downloader.AOLK
F-Prot4 4.2.1.29 11.09.2006 W32/Downloader.AOLK

File: IFinst27.exe
Status: POSSIBLY INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definitely accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5 9c17bca3ef837bacded7e4299508e71d
Packers detected: UPX

F-Prot Antivirus Found W32/Downloader.AOLK


STATUS: FINISHEDComplete scanning result of "NavilTB_Installer.exe", received in VirusTotal at 11.10.2006, 15:39:40 (CET).

Authentium 4.93.8 11.10.2006 W32/Downloader.AOLK
Fortinet 2.82.0.0 11.10.2006 suspicious
F-Prot 3.16f 11.10.2006 security risk named W32/Downloader.AOLK
F-Prot4 4.2.1.29 11.09.2006 W32/Downloader.AOLK

File: NavilTB_Installer.exe
Status: POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definitely accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5 e8ad84299c19ee67cc25e8185d0ad99b
Packers detected: UPX

F-Prot Antivirus Found W32/Downloader.AOLK


I also found two GUIDs :

B07610C1-1ADD-4264-BFFD-27364394406D
1A869745-C367-466C-82C9-F707EB969C8D

]