My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Adware.Newdotnet.U

HIGH
MEDIUM
610304

Symptoms

    The existence of the directory NewDotNet in your Program Files system folder that usually contains the following files :

newdotnet7_48.dll
uninstall7_48.exe
readme.html

    The file NDNuninstall7_48.exe in your Windows directory
    The file sporder.dll in Windows\System32 directory

(numbers in filenames can differ on other versions)

Removal instructions:

You can let BitDefender disinfect your files or you can try to manually uninstall the software following the next steps:

  1. Do one of the following:
    1. On the Windows 98 taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.

    2. On the Windows Me taskbar:
      1. Click Start > Settings > Control Panel.
      2. In the Control Panel window, double-click Add/Remove Programs.
        If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."

    3. On the Windows 2000 taskbar:
      By default, Windows 2000 is set up the same as Windows 98, so follow the instructions for Windows 98. If otherwise, click Start, point to Settings > Control Panel, and then click Add/Remove Programs.

    4. On the Windows XP taskbar:
      1. Click Start > Control Panel.
      2. In the Control Panel window, double-click Add or Remove Programs.

  2. Click New.net Domains


    Note: You may need to use the scroll bar to view the whole list.

  3. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.

Analyzed By

Mihai Cimpoesu, Virus Researcher

Technical Description:

    Adware.Newdotnet.U is a browser hijacker that adds subdomains of 'new.net' to you local name resolution system modifying the TCP/IP stack resulting in the system being to resolve names ending with .inc .familly, .shop, .travel.

    Also when you type in to your adress bar a keyword it enables searching and redirects you to http://www.quickbrowsersearch.com/search.cgi and displays results for you rearch. The main problem with this is that the search page contains links to spyware/adware programs and the results of the search are also sponsored links that may install spyware/adware on your computer.

    NewDotNet installs istself as an LSP (Layered Service Provider) within your Windows Winsock settings. Although this is not overly harmful. If New.Net is removed without fixing the Winsock addresses, it will cause a computer not to be able to connect to the Internet.

    You can get infected with this adware by manually installing it from new.net website or it may come bundled in the following applications:

BikiniDesk
Cliprex (Cliprex Lite)
GDivx
IMesh
MetaMachine (eDonkey2000)
RadLight (RadLight Standard & Subtitle Studio)
RealNetworks (RealOne Player)
UK Software (EasyFreeWebCam)
NeoNapster

Previously, it was bundled with the following software products

Babylon
BearShare
Cydoor (LingoWare)
Go!Zilla
Grokster
KaZaA
Mindset Interactive (NetPalNow)
Webshots

NewDotNet, if selected to install along with the distribution software and will install after the distribution
software installation.