NewDotNet/SaveNow

[Guest LilBambi]

If you are having problems connecting to the Internet or if some software had at some time installed NewDotNet*, these links may provide the information that may be helpful in the understanding and safely removing NewDotNet*/SaveNow:http://www.cexx.org/newnet.htmQuote from above website:

"I have written a small utility, LSP-Fix, that repairs corrupted Winsock stacks. This can be used to remove entries left behind by New.net and similar software, restoring access to machines that cannot connect to the Internet. You can download it here."

I have successfully used this little LSP-Fix to correct connection problems with IE after manually or through ad-aware removed the spyware newdotnet and it messed up the winsock and the ability to be able to surf the Internet.NOTE: SpyBot S&D will safely remove NewDotNet and does not cause the winsock to break when it removes newdotnet like ad-ad-aware has been known to do on occasion.* Links related to NewDotNet:Foistware: New Net, Inc. (NewDotNet) DLL

Update 5/6/03: New.net has filed a lawsuit against the authors of at least one well-known pest-removal product for removing its software, and hints of more to follow. The suit seeks to force them to remove New.net from their detection database, in addition to unspecified damages in excess of $75,000.New.Net is a company that sells domain names for "nonstandard" top-level domains including .free, .xxx and .shop. While several such nonstandard TLDs are currently implemented by a number of organizations and under consideration by ICANN, this particular implementation smacks of an attempt to overthrow more legitimate pioneers of alternate domain-names (e.g. OpenNIC, AlterNIC) for a quick buck. The multiple systems offering the alternate TLDs will ultimately result in widespread namespace overlap, meaning that multiple sites can be using the exact same address, and what site comes up when you enter, say, www.example.free, will depend on whose DNS server gets queried first! (As if the lawyers aren't having a field day with domain-name registrations already...). The New.net "domain names" sold for about $25 (from $50) per year are not valid domains at all, but actually fourth-level subdomains--kind of like if I were to sell you "yoursite.free.cexx.org" and tell you you're getting your very own domain name "yoursite.free". A more detailed description of the New.net domain "sleight of hand" is available here. Sadly, the worst part is how their angry customers are treated when they find this out.More recently, the New.net client has also been caught dropping additional (advertising) software on users' systems. This software promotes New.net's paid-placement search engine, firstlook.com, by displaying popup ads on a timer. More info on this program is available here. According to New.net, this marketing program has been disabled and will be removed from future versions of their software.

More links, how infection occurs, and more here:Foistware: New Net, Inc. (NewDotNet) DLL---NewDotNet Info:

DescriptionAn IE plug-in that adds subdomains of 'new.net' to your name resolution system, resulting in what appear to be extra top-level domains (.shop, and so on) being resolvable. It is not overtly harmful in intent, but counts as Unsolicited Commercial Software as it installs behind your back and its purpose is to generate revenue for its manufacturer. VariantsThere have been a number of different versions of NewDotNet. Some early versions offered no uninstall option. Originally the software was installed into the Windows directory as 'newdotnet_(number).dll'; the latest versions (detected as NewDotNet/:rolleyes: create their own folder in Program Files. DistributionA very large range of software installs New.Net, in particular file-sharing applications (at the time of writing at least KaZaA, iMesh and BearShare).

http://allentech.net/parasite/NewDotNet.html---

What is SaveNow and/or New.Net?SaveNow is a add-on product distributed by Bearshare, DivX player, Imesh, and a few other downloadable programs. Its a product made by a company called WhenU. It tracks what websites a person visits and then pops up separate browser windows with targeted advertisements and special offers. It continuously is downloading updated information about new offers and collects a variety of information.New.Net is product that is distributed in much the same way as SaveNow. Its an add-on program that has been distributed by KaZaA, Go!Zilla, Babylon, Cydoor, Gdivx, and WebShots in the past. Its purpose is to enable computers to access the website names and email addresses that are New.net has launched. Examples of these domain names are:shop .xxx .club .ltd .inc .travel .tech .sport .family .law .med .mp3 Although Newdotnet does not claim to be spyware, it has been associated with computer instability in certain situations. Both SaveNow and NewDotNet have been linked for computer instability according to the MS Knowledge Base Article 302463.

SaveNow and New.Net Removal Instructions and HelpNOTE: PCHell also has pages for Removal Instructions for other Spyware programs as well at this link.---

The New.net Application plug-in may be installed when you install certain Web accelerator or file-sharing programs. This plug-in may be included with programs supplied by the following companies: Go!ZillaBearShareMP3.comiMeshBabylonCydoorWebshotsgDivx The SaveNow program may be installed when you install the WhenUShop program. Additional information about SaveNow is available from WhenU.com at the following URL: http://www.whenu.com NOTE: In some cases, you may need to manually uninstall the New.net software.

http://support.microsoft.com/default.aspx?...b;en-us;Q302463

[SonicDragon]

Thanks!Lots of good info!

[Guest Paracelsus]

Fran... As usual, you come up with some amazing stuff!! This is one of those things that would drive a lot of people (like myself) NUTS... tying to figure out what might be causing problems.

[Guest LilBambi]

Thanks SonicDragon and Paracelsus ... these little nasties have been no end to problems among folks!