First of all we have to remove Newdotnet, either from add/remove programs, or by going here and scrolling down to the uninstall tool.
Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/cus...://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cus...://my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: Yaya Show BB - {29F7B7FA-ADC8-48ea-9E1C-EA87A05AE642} - D:\WINDOWS\System32\sbb.dll
O2 - BHO: (no name) - {667256FE-E39F-F7BB-E855-C11638A07289} - (no file)
O2 - BHO: D:\WINDOWS\lbbho.dll - {A9B30C04-FA60-48D4-956F-350AAE6D6E8D} - D:\WINDOWS\lbbho.dll
O3 - Toolbar: (no name) - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - (no file)
Reboot and post another log.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Only posted half a log :). Try this before we do anything more.
Download & instal Spybot S&D 1.3 from here. Update it before scanning.
After the scan is complete, have spybot fix everything marked RED.
On the page that first opens when you start Spybot there is an option to immunise, you should do this. In the immunise section there is also a link to download Spywareblaster. This program will prevent the install of bad activex controls that it has knowledge of. Download that & you can keep it updated by selecting the same link that you use to download it. Reboot
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Somewhere along the way Newdotnet has been partially removed. The correct way to remove it is the way I indicated earlier. Any other way and you can lose the internet connection.
As you can see in your log, line 010 indicates that Newdotnet has hijacked your connection. The only effective way I know to fix it is *as above.* Hijackthis will not fix those lines in the log. Spybot normally will fix them. Because they have somehow become corrupted, Spybot has been unable to clean up :(.
You can try the following, with no guarantees.
Download LSPfix from here
Do the following if you lose your internet connection after *fixing* with hijackthis.
On the opening screen of LSPfix, click the "I know what I'm doing" checkbox. Then click Finish. That will restore the connection.
Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O4 - HKLM\..\Run: [New.net Startup] rundll32 D:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
Reboot into safe mode and delete the D:\PROGRA~1\NEWDOT~1 folder.
Reboot normally after doing the above, rescan with hijackthis, then post that log here please.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Try bypassing the proxy you have running and see if you can access them. You can also try putting them in the trusted zone.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Your log shows that you are using a proxy.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1030
Running from localhost (your PC) from port 1030. Looking at it again, I think the http is out of place.
It may be best to fix it with hijackthis and go from there.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Do you have anything disabled in msconfig? Go to Start\run and type in msconfig, hit ok and go to the startup Tab. Make sure all entries are checked for startup. If any were found to be disabled, reboot after re-enabling them and post another log please.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
