[Brian of Ankara]

My PC has become enslaved by a vicious program that interrupts the browser, in my case, Mozilla, and forcably directs a query to Quickbrowsersearch.com.
Are people having difficiulties with Quickbrowsersearch.com hacking their browsers? There is, I assume, the associated software called newdot.net. Newdot net claims benefits for some type of pretend filename extensions, such as 'family'. The malware and spyware nature is that gratuituous pop ups appear as keyword searches are directed to Quickbrowsersearch.com.

A very worrying aspect is that the full version of Spyware Doctor does not pick this program up. What's going on?

My sad saga is as follows:

1. Using Google I managed to locate a file called Newdotnet.dll in C:\Programfiles\newdotnet\ .

2. With Zone labs privacy, I prohibited access to www.quickbrowsersearch.com

3. I then removed newdotnet.dll to newdotnet.rubbish and then discovered that I had no internet access, or according to the PC, weakened internet access because my PC had no address.

4. Eating humble but furious pie, I allowed this evil program to operate once again so I could get access to removal means.

5. Going to Newdotnet.com I unloaded an uninstall file (which has a prohibition on copying and distributing!!) and four or five options are presented.

6. The uninstall program has allowed access to IE, but not to Mozilla AND the Newdot net files are now happily still there.

Is it me or is it 'them'?

Brian


ps

HELP!!

[mariamt]

Hi

Theres an interesting article here about netdotnet.dll:

http://www.wintipz.com/Troubleshooting/Tro...netExplorer.htm

[Jacee]

Download LSP-Fix from the following link and save it to a location you can find later if necessary. LSP-Fix Download Link***

To remove New.net. please go to Start | Settings | Control Panel | Add/Remove Programs, look for and remove New.Net.
If you can't find it, then go to http://www.newdotnet.com/removal.html and follow the removal instructions in Procedure 4 at the bottom of the page.

***If you can not connect to the Internet after removing New.net, run the LSP-Fix program I had you download earlier, and click on the finish button. Reboot and you should be able to get back on.

Go into program files and delete the entire New.Net folder

Reboot

[Ryan233]

Are you using StyleXP or any other windows enhancement software because I got Newdot.com after downloading new themes for StyleXP. It comes bundled with themes and skins. Try CA Pest Patrol 5-- great program!

[BillPStudios]

Great tips!

What's funny is NetDot is routinely at the top of the list of Unwanted Programs which WinPatrol member request PLUS data on.

But I never see NewDot mentioned on other Top Spyware lists.
Even the top 25 list here doesn't have an report of NewDot problems. Dave and I talked about it once but couldn't figure out why.

This is one I've heard of people formatting their systems to get rid of because they didn't know about LSP-Fix.


Bill

[mariamt]

Newdotnet bring lawsuits against anyone who tries to warn the public. Ad-aware (lavasoft) being one of those they have brought a law-suit against. You can read all about it in the link i gave in my earlier post ( the link in the first paragraph to cexx.org tells all!!)

[TeMerc]

Funny thing, NEw.Net just got added back into detections with Spybot with the 11\04 defs:

2005-11-04

Hijacker
+ Smitfraud-C.
+ StarWare
+ FatPickle
+ Cram Toolbar
+ CoolWWWSearch.Feat2Installer
+ CoolWWWSearch.Service
+ CoolWWWSearch.Feat2DLL

Keylogger
+ GoldenKeylogger

Malware
+ SurfAccuracy
+ SpySpotter
+ Nat

PUPS
+ New.Net
+ Registry Cleaner (2)
+ Download Accelerator Plus

Spyware
+ Huntbar

Trojan
+ Elitum.EliteBar

And this is the apparant reasoning behind the adition, which I was unaware of:

When Spybot-S&D 1.4 was released the C:%path%\Spybot - Search & Destroy\Excludes\Bots file that controls product exclusions contained the following entries by default:
CDilla
New.Net
New.Net.QuickSearch
SideStep
As I understand the situation, the status of those products was under review at the time Spybot-S&D 1.4 was released. The products had been de-listed but some remained in the detection database pending farther review.

At that time if you went into the "Ignore products" list the following four (4) items were checked:
CDilla - PUPS
CDilla - Revision
New.Net - PUPS
SideStep - PUPS
You will note that New.Net.QuickSearch had already been removed as a detected product. Although it was in the file as an exclusion it did not appear as a checked item in the "Ignore products" list.

Subsequently, it appears that the detection for New.Net - PUPS has been replaced with a detection for NewDotNet - PUPS hereby negating the original New.Net default exclusion.

http://forums.spybot.info/showthread.php?t=336

[Jacee]

I know C_Dilla and New.Net need to be removed properly, or your machine will be in big trouble. :crash:

Removing C_Dilla will render some programs disabled

[TeMerc]

I know C_Dilla and New.Net need to be removed properly, or your machine will be in big trouble.  :crash:

Removing C_Dilla will render some programs disabled

And that's a funny thing too. It used to be, way back before New.Net set up that page, you could easily remove the infection via Add\Remove and HJT, excluding of course winsock related lines.

I used to run into them all the time at Cexx when I first started doing logs, and never had problems.

Now users have to go to that page, and follow the instructions implicitly.

[Jacee]

I think it was Ad-Aware that removed New.Net way back.....I remember reading about it at Cexx.

I had Spybot remove C_Dilla on my 98se....I was furious with the retail CD I'd listened to (it came bundled with it), Spybot and most of all that blasted C_Dilla!