Adware.NDotNet

[luna72]

Salve a tutti vi ho letto spesso in silenzio e non posso che esservi grata per aver risolto già tanti dei miei problemi con questa macchina infernale ma ahimè necessaria.
Stavolta però ho bisogno di un aiuto... più attivo
Come s.o. ho xphome service pack2 con tutti gli updadate del caso e come antivirus ho norton 2002 (lo so... vecchiotto ma nei limiti del possibile aggiornato).
Da una scansione con symantec security chech (virus detection) mi trova due files infettati:

C:\WINDOWS\NDNUNINSTALL4_85.exe
C:\WINDOWS\NDNUNINSTALL6_22.exe

entrambi con Adware.NDotNet.

Nè adware nè spybot trovano il malware e poichè di inglese ne capisco almeno quanto questa maledetta macchina capite bene che sono completamente in panne.
E' possibile ricevere informazioni (tenendo conto della mia abissale ignoranza in materia) su come eliminare il problema?
Grazie.

[kadosh]

Dal sito Symantec (purtroppo solo in inglese) hai questo:

The following instructions pertain to all Symantec antivirus products that support Expanded Threat detection.

Update the definitions.
Uninstall New.net using the Add/Remove Programs utility in Control Panel or NDNuninstall6_38.exe found in the %Windows% folder.
Run a full system scan, and delete all files that are detected as Adware.NDotNet.
Delete the value that was added to the registry.

For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To uninstall the Adware
Do one of the following:
On the Windows 98 taskbar:
Click Start > Settings > Control Panel.
In the Control Panel window, double-click Add/Remove Programs.


On the Windows Me taskbar:
Click Start > Settings > Control Panel.
In the Control Panel window, double-click Add/Remove Programs.
If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."


On the Windows 2000 taskbar:
By default, Windows 2000 is set up the same as Windows 98, so follow the instructions for Windows 98. If otherwise, click Start, point to Settings > Control Panel, and then click Add/Remove Programs.


On the Windows XP taskbar:
Click Start > Control Panel.
In the Control Panel window, double-click Add or Remove Programs.


Click New.net Domains 3.88.

--------------------------------------------------------------------------------
Note: You may need to use the scroll bar to view the entire list.
--------------------------------------------------------------------------------

Click Add/Remove, Change/Remove, or Remove (depending on the operating system). Follow the prompts.

3. Scanning for and deleting the files
Start your Symantec antivirus program, and run a full system scan.
If any files are detected as Adware.NDotNet, click Delete


--------------------------------------------------------------------------------
Notes:
If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.
If you ran the Add/Remove programs applet as described in the previous section, it is possible that all files were removed; therefore, none will be detected.

--------------------------------------------------------------------------------


4. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document, "How to make a backup of the Windows registry," for instructions.


Click Start > Run.
Type regedit

Then click OK.


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value:

"New.net Startup"="rundll32 C:\Progra~1\Newdot~1\Newdot~1.dll, NewDotNetStartup"


Navigate to and delete the subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net
HKEY_LOCAL_MACHINE\SOFTWARE\New.net
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2
\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2
\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2
\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2
\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2
\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
HKEY_CLASSES_ROOT\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tldctl2.Tldctl2c
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tldctl2.Tldctl2c.1
HKEY_CLASSES_ROOT\Tldctl2.URLLink
HKEY_CLASSES_ROOT\Tldctl2.URLLink.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD521A1D-1F98-11D4-9676-00E018981B9E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tldctl2.URLLink
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tldctl2.URLLink.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Explorer\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage
\C:/WINDOWS/Downloaded Program Files/tldctl2.ocx


Exit the Registry Editor

[luna72]

Grazie davvero kadosh. Avevo già individuato quella possibilità ma l'inglese, per me, è un ostacolo non superabile.