topic Re: spybot result in Operating System - Microsoft

spybot result

Vonda van Raamt — Mon, 05 Dec 2005 00:13:18 GMT

The scan with spybot revealed this result: NewDot
(date.C:\windows\winit.ini Kann nicht geoffenet werden. Translation:
cannot be opened. I have no idea why this came up in the German language the rest came up clean
and what it means. This is a brand new pc (Nov.28)

I would appreciate the help, thanks

Re: spybot result

Dexter Filmore — Mon, 05 Dec 2005 00:33:55 GMT

Maybe the file is in use by windows. Try booting into safe mode and running spybot again.

Re: spybot result

Vonda van Raamt — Mon, 05 Dec 2005 10:40:45 GMT

Hi Dexter,I got the same result in safe mode, see attachment,would you have another suggestion?

Re: spybot result

Igor Karasik — Mon, 05 Dec 2005 12:48:39 GMT

Which SpyBot version you use?
It maybe false positive alert.
Check your computer with Lavasoft Ad-Aware SE Personal Edition
http://www.download.com/Ad-Aware-SE-Personal-Edition/3405-8022-5153545.html?part=dl-ad-aware&subj=dl&tag=top5
and Microsoft AntiSpyware http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

Re: spybot result

Richard Darling — Mon, 05 Dec 2005 14:10:19 GMT

Vonda,
This program isn't somehting you want to keep - could be a Trojan or an IE hijacker. The easiest way to get rid of it is to follow the above suggestion and use Microsoft AntiSpyware:
http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en
Richard

Re: spybot result

Vonda van Raamt — Mon, 05 Dec 2005 16:33:37 GMT

Hi Igor,
I did use Ad-Aware from lavasoft as well and it did not detect anything except a few mru's. I did a scan with the beta anti spyware you recommended and it did not find anything suspicious.

Re: spybot result

Vonda van Raamt — Mon, 05 Dec 2005 16:36:15 GMT

Hi Richard,
should I still remove that file or should I wait for futher suggestions?

Re: spybot result

Richard Darling — Mon, 05 Dec 2005 16:41:36 GMT

Hi Vonda,
I'd definitely remove it using the MS Anti-Spyware.
Richard

Re: spybot result

Richard Darling — Mon, 05 Dec 2005 16:43:26 GMT

Vonda,
if you feel more comnfortable getting more info. check this link out:
http://www.liutilities.com/products/wintaskspro/processlibrary/newdot/
Richard

Re: spybot result

Dexter Filmore — Mon, 05 Dec 2005 17:44:06 GMT

Try updating to the latest version of spybot (v1.4)if you haven't already done so. Then try scanning again to see if the same problem occurs.

Re: spybot result

Randy C. — Tue, 06 Dec 2005 03:59:28 GMT

Vonda,

Don't know if this helps, but NewDotNet (new.net) is a piece of software that appears to be from the same people that brought us the quicksearch toolbar :-(

This page has an explanation of the what the software does http://www.doxdesk.com/parasite/NewDotNet.html

The creator says it can be removed via add/remove software in windows or through their uninstaller. Check out the page at http://www.newdotnet.com/removal.html

Hope this helps.

Randy

Re: spybot result

Omar Senussi — Tue, 06 Dec 2005 05:18:15 GMT

Hi,
If you are still struggling with this, get Hijackthis from majorgeeks.com, or cnet and run it, post the log and we'll take a look. You could also try and remove the offending item using Hijackthis..

Good luck.. Omar

Re: spybot result

Ronald Postma — Tue, 06 Dec 2005 06:17:05 GMT

Hi Vanda,
Check if you have the program NEW.NET installed on your system, you can check it in control panal->add remove programs

You can uninstall it their if it is on your system but you would probebly get an error on each boot that a file can not be openend or something like that, can not rembermber exact error. This message is not harmfull, only irritating, their is a procedure to delete it, but lets first see if you have the program installed.

NEW.NET is a browser plugin that can serious block network trafic, atleast it did that her, it was automaticly installed from a www.babylon.com or .nl (not sure anymore)

Hope this gets you a step futher,
Regards, Ronald

Re: spybot result

Alan_152 — Tue, 06 Dec 2005 10:21:19 GMT

You might also try attacking the problem with Ad-Aware and CCleaner. I find that between the 3 products that almost all spyware is taken care of...

Re: spybot result

Vonda van Raamt — Tue, 06 Dec 2005 11:58:41 GMT

Thank you all for the replies so far. First I did use the recommended anti spyware from MS, I will now try to download the newer version of spybot. I checked in Ad-remove programs, but the New.Net is not present there. see attached log from HJT

Re: spybot result

Tom Leavitt — Wed, 07 Dec 2005 04:53:47 GMT

Vonda:
Symantec Security Response has developed a removal tool for this security risk. Use this removal tool first, as it is the easiest way to remove this risk.
The tool can be found here: http://securityresponse.symantec.com/avcenter/FxNdotN.exe
Please let us know.
Tom

Re: spybot result

Omar Senussi — Wed, 07 Dec 2005 06:20:15 GMT

Right Vonda,
I think we may be chasing a red (or perhaps a pink) herring!

Just looking carefully at your original post, all that appears to be saying is that something has removed that file [antivirus or antispyware app?] (please check the spelling of the file(wininit.ini or winninit.ini) as there appear to be references to different flavours on the net.

In either event, I would look for any reference to it in the registry, win.ini(if present)

In any event, it doesn't appear to be a "clear and present danger"

Re: spybot result

Vonda van Raamt — Wed, 07 Dec 2005 10:55:52 GMT

Thank you all. the removal tool from symantec disclosed that there was no problem