(Image:\\Microsoft\\Network\\svchost.exe OR (CommandLine:\\Windows\\Caches\\NavShExt.dll* CommandLine:\/c\ del*)) OR ((CommandLine:\\AppData\\Roaming\\MICROS\~1\\Windows\\Caches\\NavShExt.dll OR CommandLine:\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\NavShExt.dll) CommandLine:,Setting*)