new.net

[JosieSlift]

A user on our network at work, his computer lost all access to the network this morning. Everything is set up correctly, adaware, spybot, and hijackthis have all been run sucessfully. In hijackthis! there was a new.net entry that would keep appearing no matter how many times it was removed, but now its gone.

When you use any tcp/ip or any ip related commands, there are strange ascii characters, and ip address resolution is all jacked up. Hijackthis! says new.net can inject directly to the tcp/ip stack and overwrite the /renew /release commands. MS has a knowledgebase fix for jacked up tcp/ip, says to uninstall and reinstall it (only ive not been able to find a way to remove tcp/ip, greyed out). I deleted the appropriate regentries (winsocks), and nothing is showing up in hijackthis or any other adware/spyware/antivirii, but the computer still cant see the network and tcp/ip is still jacked.

Any insight? We'll probably just end up wiping the drive and putting a generic back up image on there... but it's frustrating to not be able to fix this w/o wiping it.

thanks in advance!!

 

[JosieSlift]

PS!

this is the error it gives when you try ipconfig /renew or /release:

Operation Was Attempted on Something That Is Not a Socket

 

[smah]

Once you're sure you have removed new.net (newdotnet) use this tool:

Lost Connectivity after Registry or Malware Cleanup
faq779-4625

 

[JosieSlift]

thank you for introducing me to this little program, it seems very slick

 

[smah]

Don't leave home without it...