error message on start up

[malory]

i run windows xp, when i log into any account i receive this error message
C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL
i am not able to open Internet explorer or download any updates, i have tried to find the problem Dll file in misconfig but when i restarted the computer it would keep starting as before
Please help!!

 

[dogbonz]

Hi malory,

NEWDOT is a nasty bit of spyware. Download "Spybot" and run it.
Don't remove any sections of it - just use Spybot.

 

[caton-phil]

Well, what can I do??? I am getting the same message. It must have come on some "free" software that I downloaded and have since got rid of. I have tried all the things suggested and it STILL keeps coming up. It seems to re-enable itself in the start up even if I uncheck it. What to do??

Phil

 

[dogbonz]

Hi caton-Phil,

As noted previously, get "Spybot Search & Destroy", download
it and update it. It will kill new.dot.

Also go to www.lavasoftusa.com and get "Ad-Aware" and update it
as well. You gotta clean off the spyware once a week at least.

 

[cword6]

When I started up my user account for windows XP I recieved a message saying that the file SHDOCVW.dll was missing and that re-installing the application might fix it. Here is where the problem comes in. I can sign on to the user account, but all I recieve is a desktop with no icons or a start menu. The only way for me to open programs is with the task manager and even then I can only open the programs and not the files in a separate window.

 

[Swiper]

When this happens, go into TASK MANAGER
Click on FILE / NEW TASK
Type in EXPLORER.EXE and poof
Your Icons / desktop will appear again

Then clean up that PC really quickly.....

 

[cword6]

Didn't work. Used the same excuse that it did when I signed on.

 

[Swiper]

Running PRO or HOME version of XP ?
With or without SP2 ?

 

[cword6]

I'm running pro, but just in case tell me both. I have the SP2

 

[Swiper]

http://swiper.the.fox.home.comcast.net/shdocvw.zip

download my copy of that file ( I run SP2 / PRO as well ) and...
extract this file to C:\Windows\System32\ folder


hope for the best....

 

[cword6]

Gave me the same message. Again.

 

[caton-phil]

I am still getting the error;
C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL
I have Adaware and have run it, and have downloaded and run Spybot and run it. It is still there. I go via msconfig and find I have 2x newdot2. One is unchecked and I uncheck the other. But when I reboot the error is there again and I use msconfig to find one of the newdot2 checked again
Help!
Not a serious problem but very very annoying.

Phil

PS I am running Ad watch. Will that affect things???

 

[Swiper]

Go into ADD/REMOVE programs and uninstall NEWDOT DOMAINs entry
Go to START, ALL PROGRAMS,STARTUP and make sure its not listed in here either.

From MSCONFIG, located where this file is located in the registry and delete it right from the registry and see if that helps....

In REGEDIT, you can also do a search for NEWDOT and delete any/all of these entries it finds. this may or may not help, but NEWDOT is almost as annoying as hotbar

good luck

 

[Swiper]

Gave me the same message. Again.

When you are extracting this file, does it prompt you to overwrite the current one ? If not, then it is not going to same location.....

 

[caton-phil]

IT IS STILL THERE!!!!!!!

I have run hijack this, found and checked the offending file, clicked the fix it button, then scanned again and it is still there.

This is my hijack this log:

Logfile of HijackThis v1.97.7
Scan saved at 19:07:04, on 20/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\MsPMSPSv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Classic PhoneTools\CapFax.EXE
F:\PROGRA~1\Grisoft\AVG7\avgcc.exe
F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
F:\Program Files\SpywareBlaster\sbautoupdate.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
F:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
F:\Program Files\SpywareBlaster\sbautoupdate.exe
F:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Microsoft Office\Office\1033\msoffice.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Documents and Settings\Phil\My Documents\PROGRAMMES\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by V21
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: (no name) - {58A83E4F-477A-4A3F-BF9B-B65BC2BD5598} - (no file)
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [CapFax] F:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SBAutoUpdate] "F:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "F:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [Ad-watch] "F:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "F:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [MSPY2002] F:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [HydraVisionDesktopManager] F:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [HydraVisionViewport] F:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 F:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - F:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: TREND MICRO HouseCall (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .bcf: F:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/support/chipdetect/OSInfo.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downl...-a3de-373c3e5552fc/msSecAdv.cab?1083762257500
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38112.5966319444
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://sea2fd.sea2.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

As I say, I uncheck the newdot and ask it to fix and when I scan again it is back. Am I missing something???

Thanks

Phil