How to fix a botched newdotnet uninstall?

[riddellcomp]

Hello,

I am trying to repair a botched up newdotnet uninstall where the computer no longer has internet access. The machine is running XP Pro. I am confident that newdotnet has been removed completely. The folder is gone and a seacrh for newdotnet gives no returns. The registry has no reference to it either.
I ran a hijack this scan and got this the first time around.

Logfile of HijackThis v1.97.7
Scan saved at 5:44:21 PM, on 22/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\wendy\Desktop\HijackThis.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D7D5610-60A8-DC11-F277-F5FBBAAF7455} - C:\DOCUME~1\Jack\APPLIC~1\MAPIWE~1\DELETE PROC.exe
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1098158582113


I removed what I thought was no good and also used a newdotnet uninstall tool.

The hijack this log now looks like this.

Logfile of HijackThis v1.97.7
Scan saved at 8:14:14 PM, on 22/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\wendy\Desktop\HijackThis.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D7D5610-60A8-DC11-F277-F5FBBAAF7455} - C:\DOCUME~1\Jack\APPLIC~1\MAPIWE~1\DELETE PROC.exe
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1098158582113


I have run lspfix and the winsock fix but they still didnt restore the internet connection.

Also it was interesting to note that when the browser returns a "The page cannot be found" page there is a list of search headings with sub headings and a search bar just above the
"Please try the following...." section.
And the browser title bar says "Search the web..."
If I click on one of the links the page will not open either.

Not sure if this is related to newdotnet or something else and I dont know what else to do to fix this. Any suggestions?

Thanks in advance.

[Damned Angel]

try an adaware scan. There may be other apps causing it.

[riddellcomp]

try an adaware scan. There may be other apps causing it.

But the loss of the internet connection only happened when he tried to remove newdotnet manually. (Which I have read will often cause internet connection loss. Although usually the lspfix is supposed to work.) Whilst he may have other spyware that adaware could pick up, wouldn't the internet connection problem be something else that we need to try?

[Cyphrr]

Are you on a static IP or DHCP? If DHCP do you get an IP address?

[riddellcomp]

Following some instructions I found on the net I renamed winsock and winsock2 to old in the registry. I then rebooted and reinstalled tcp/ip.
I seem to have a connection of sorts but just cant seem to connect to the internet or e-mail and cannot ping any sites.
If I open a browser window there is some modem activity but the page never opens and I get the same page cannot be found error with the title bar saying search now.

[gemineye]

Try an internet explorer repair and have you looked in the hosts file to see if anything untoward has been entered
Also if you are connected to the internet check ipconfig /all ( for XP and 2000) or winipcfg ( for 98) to see what addresses you get and do they conform to what your ISP's settings should be

[nunob]

Hey Riddellcomp, Try the new version of Hijackthis 1.99.0 it has a process viewer and other tools that might help under misc. tools.

[cheeseh]

Why not just use the newdotnet uninstaller which fixes all the problems it causes? The uninstaller removes all network settings changed by it and removes all files. You can find it at their website.

[geeksRus]

LSP-Fix is a free utility to repair a specific type of problem associated with certain Internet software. This type of software is known as a Layered Service Provider or LSP, a piece of software that can be inserted into the Windows TCP/IP handler like a link in a chain. However, due to bugs in the LSP software or deletion of the software, this chain can get broken, rendering the user unable to access the Internet.

LSP-Fix

[riddellcomp]

I have already tried the lspfix and the winsockxpfix but neither worked. I also tried the newdotnet uninstaller but because newdotnet had been partly removed already the uninstaller didnt work properly. I am confident that newdotnet is gone, its just the internet connection I have to get up and running again.
I checked the adsl routers settings and noticed that the username and password were gone although I cant see why this could be. At the time the owner of the pc wasnt home, only her son. So I couldnt put the details back in. I am waiting from them to call.

I cant see why these settings could be gone though????

[cyberhh]

When you go to the command prompt and type: ipconfig , what do you get?

Do you have an IP address? If you try: "ipconfig /renew" do you get an error message (you are trying this on something that is not a socket, or some such)?


I have used LSPFix many, many times to fix similiar problems and never found LSPFix to be at all automated, or intuitive and almost always I have to select "I know what I am doing" and remove one or more installed dll's from the system, after which the machine begins working properly.

The trick that I use is to check the version information of all the DLL's that lspfix returns from it's scan for manufacturer information. I always back up the registry and the dll's before I remove them, but the ones that are causing the problem are recognisable (sp?) as not belonging and are easy to remove. If you are unsure you can also search google.com for that filename and seeing some of the results - typically google will find something that lists specifics on the DLL.

You can also post back in here for more help.