Home / malware

PDF

Adware:Win32/NewDotNet

First posted on 25 October 2019.
Source: Microsoft

Aliases :

Adware:Win32/NewDotNet is also known as AdWare.Win32.NewDotNet, NDotNet, W32/NewDotNet.A, Spyware/New.net, NewDotNet, Adware.NDotNet, Adware_NewDotNet, Adware.NewDotNet.AA.

Explanation :

NewDotNet software serves as an access point to Web sites sponsored by New.net, Inc. The software enables a Web browser to connect to New.net-sponsored Web sites when valid abbreviations of New.net-sponsored URLs are entered in the browser address bar. NewDotNet also installs the Quick! Toolbar, a browser helper object (BHO) that presents a list of New.net-sponsored Web sites based on search keywords, mistyped URLs, or invalid URLs that a user enters in a browser address bar.  After it is installed, NewDotNet may install updates and other programs automatically. NewDotNet may integrate as a Winsock layered service provider (LSP); improper removal of NewDotNet can therefore cause loss of Internet connectivity. NewDotNet typically consists of two programs: NewDotNet Domains. This component causes a Web browser to connect to a New.net-sponsored Web site when an abbreviation matching a NewDotNet-sponsored URL is entered in the browser address bar. This may occur under either of the following conditions: A NewDotNet browser plug-in is installed on the computer.  The user's upstream Internet service provider is a NewDotNet partner. Quick! Toolbar. This program installs as a BHO and presents a list of New.net-sponsored Web sites based on search keywords, mistyped URLs, or invalid URLs that a user enters in a browser address bar. The program may also collect configuration information from the host computer, such as IP address, operating system, browser type and version, NewDotNet version, and the NewDotNet download source.  NewDotNet may create a folder named newdotnet under %ProgramFiles%. The software may install the following files:%ProgramFiles%
ewdotnet
ewdotnet.exe%ProgramFiles%
ewdotnet
ewdotnet.dll
%ProgramFiles%
ewdotnetuninstall.exe Downloaded Program FilesCONFLICT.1 ldctl2.ocxDownloaded Program Files ldctl2.inf
dnuninstall.exe
ew.reg
NewDotNet may modify the registry as follows in order to run automatically each time Windows starts:Create value: New.net Startupwith data: rundll32 %ProgramFiles%NewDotNetNewDotNet.dll,ClientStartup –s in subkey: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun NewDotNet may also create or modify the following registry subkeys:
HKEY_CLASSES_ROOTCLSID{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallNew.net HKEY_LOCAL_MACHINESOFTWARENew.net
HKEY_CLASSES_ROOTTldctl2.URLLink
HKEY_CLASSES_ROOTTldctl2.URLLink.1 During installation, NewDotNet may place an uninstallation program with display name "New.net Domains " in Add or Remove Programs in Control Panel. After NewDotNet is installed, it may install updates and other programs automatically.

Last update 25 October 2019

 

TOP