Hmmmm What are these

gogot,

First download and install the following programs:

1) AdAware SE Personal; check for malware-signature updates.
2) Spybot S&D; check for malware-signature updates.
3) Asquared2 from www.emsisoft.com; check for trojan-signature updates.
4) HiJackThis; v1.98.2.
5) LSPFix from CEXX.org.

First, browse to www.trendmicro.com and run their online virus scanner. Let's see if it can remove the re-infector.

Next, run Asquared2, AdAware SE Personal, and Spybot S&D (one at a time).

Watch out when removing problems like NewDotNet. If you 'fix' them with these programs, you could loose internet connectivity (that's where LSPfix will come in). If your not sure whats what, just do a GOOGLE on the problem, it should turn up something as reference. Then just see if anyone else has had problems using either of these programs to fix the 'baddie'.

If they have any problems fixing things they find, try running them again from "Safe Mode".

After that, place HiJackThis in it's own folder (not in a temp directory), and run it. Click "Scan", then "Save log". Copy/paste the text from notepad, and post it back. Don't attempt to 'fix' anything, no matter how strange it looks, unless your sure about what the entries are.

Mike.

Thanks,  tried all these and still nothing works so far. Tried to google it but nothing on any search engines so far. Its now spreading through the campus so we have a problem but what this does (dvdarb) is yet to be known.  Wish us luck.

gogot

If you are not getting hits on a particular file, it is probably a bad file. If you get something that you think is bad, you could try renaming it to see if that helps the problems. The problem with renaming or fixing just an apparent bad file is that many times there is another reloader somewhere that is less obvious. Posting a hijackthis log from one of your troubled machines would allow the people here to see your problem processes in the environment of all processes running on the machine and maybe offer you a suggestion that would allow you to get the machine fixed.

Regards.

cg

Hi. Firstly, you sound very capable. Experience has indicated that a SYSTEM RESTORE is necessary after deleting in the Registry Editor. This might well be done OFF-LIne. Restore is at start/help support/RESTORE. It can't hurt to delet the cookies as well. start/explorer/tools/options/delete cookies

This is just a bystanders proposal.

Tried all of these and still nothing. security here prevents me from posting our hyjackthis logs, wish I could.  Our programer wrote a script that worked for about one hour than it came back again under yet back with a differant name each time.  They decided to wipe all infected computers but 2 ( the 2 for research). We did confirm it is sending out data somewhere.  Realy want to nail this bugger down but not being able to even know its name is a head ache and half, or it point of origin. At least it has yet to anything other than s*cking memory and cpu resources.

Again thanks all for the help.

Gogot.

They could be located in the Registry in more than one reticule. Lastly, nothing works better than REBOOTING with the Restore Disks for Windows. An excellent atttempt would be to contact support@msn.com.