FANDOM or is a malicious PE .exe file. The length listed above is when it is packed with UPX, unpacked it comes to 32 KB.


When run, the trojan will copy itself three times under the following names:


It also adds a registry key to ensure it always starts on bootup.

"(Default)" = "%System%\NavbwvLw32.Exe"


When launched, the trojan will search for the following antivirus products and if any one of these is found it will terminate found antivirus and delete itself.

Norton AntiVirus
eSafe Desktop Watch
eTrust EZ AntiVirus
Panda AntiVirus Titanium
PC-Cillin 2002
PC-Cillin 2003
F-Secure Anti-Virus
Sophos AntiVirus
ZoneAlarm Pro
Tiny Personal Firewall
McAfee Firewall
Norton Personal FireWall


1. Delete all copies of the trojan, both the original, and the three copies in the Behavior section.

2. Delete the following key


"(Default)" = "%System%\NavbwvLw32.Exe"

3. Scan with any trusted antivirus program.


Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.