PC Hell: How to Remove SaveNow and NewDotNet (New.Net) Programs

SaveNow is a add-on product distributed by Bearshare, DivX player, Imesh, and a few other downloadable programs. Its a product made by a company called WhenU. It tracks what websites a person visits and then pops up separate browser windows with targeted advertisements and special offers. It continuously is downloading updated information about new offers and collects a variety of information.

New.Net is product that is distributed in much the same way as SaveNow. Its an add-on program that has been distributed by KaZaA, Go!Zilla, Babylon, Cydoor, Gdivx, and WebShots in the past. Currently it appears to be distributed with eDonkey2000, IMesh, GDivx, NeoNapster and a few others.Its purpose is to enable computers to access the website names and email addresses that New.net has launched.

Although NewDotNet does not claim to be spyware, it has been associated with computer instability in certain situations. Both SaveNow and NewDotNet have been linked for computer instability according to the MS Knowledge Base Article 302463.

A Hijackthis log will show the following entries with a SaveNow or NewDotNet infection

C:\Program Files\Save\Save.exe

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

Both of these programs can generally be removed through the Add/Remove Programs Control Panel under Normal Circumstances.

1) Click on Start, Control Panel, Add/Remove Programs
2) For SaveNow, search for Save!, SaveNow, or WhenUShop entries and click on Change/Remove to remove them
3) For NewDotNet, look for New.Net Domains and choose to Remove it.
4) Reboot your computer and SaveNow and NewdotNet should be removed.

For NewDotNet, sometimes the normal procedures do not work. If this is the case, follow the instructions below for more advanced removal of NewDotNet.

NewDotNet Removal PROCEDURE 2 (Uninstall from Hard Drive):

1. Double-click on My Computer.
2. Double-click on the C: drive.
3. Double-click on the Program Files folder.
4. Locate and double-click on the NewDotNet folder. If there is nofolder, please proceed to PROCEDURE 3.
5. Locate and double-click on the uninstall executable; it willbe labeled uninstallX_XX.exe. (“X” represents the version number of the uninstaller)
6. After removal of our software, you may be prompted to reboot.
Please reboot after removing our software.
7. If this does not fully remove our software, please proceed to PROCEDURE 3.

NewDotNet Removal PROCEDURE 3 (Locate Backup Copy of Uninstaller and Uninstall from Hard Drive):

1. Double-click on My Computer.
2. Double-click on the C: drive.
3. Double-click on the Windows or Winnt folder.
4. Locate and double-click on the uninstall executable; it will be labeled NDNuninstallX_XX.exe. (“X” represents the version number of the uninstaller)
5. After removal of our software, you may be prompted to reboot. Please reboot after removing our software.
6. If this does not fully remove our software, please proceed to PROCEDURE 4.

NewDotNet Removal PROCEDURE 4 (Download Uninstall from New.net):

1. From a computer that has Internet access, click on the following link:

http://www.new.net/support/uninstall7_22.exe

2. Download and save uninstall7_22.exe to a 3-½ floppy disk.
3. Insert the floppy disk into the floppy drive of the computer that needs to have our software uninstalled from.
4. Click on Start.
5. Click on Run.
6. In the Open window, type A:\uninstall7_22.exe.
7. Click on the OK button.
8. After removal of our software, you may be prompted to reboot. Please reboot after removing our software.

If the above 4 procedures do not fully remove our software, please contact New.net Customer Support at (626) 405-2000 or at
support@new.net.

Because New.Net affects the Internet access on a computer, sometimes after removing it, you wont be able to go anywhere on the Internet. If this happens, follow these instructions.

1. From a computer that has Internet access, click on one of the following links and download the program:

LSPFix by Cexx.org

Winsock XP Fix

2. Download and save one of these programs to a 3-½ floppy disk.
3. Insert the floppy disk into the floppy drive of the computer that needs to have our software uninstalled from.
4. Open My Computer on the infected system.
5. Double-click on Drive A.
6. Run the WinsockXPFix file or the LSPfix file to fix broken Winsock connections