Challenging Times.. Foistware

Many Computer problems can be extremely plodding repetitive work to correct. Computer repairs are particularly un-challenging when it involves removing the aftermath of the latest virus attack for the fourth time in a week or formatting the Computers Hard Drive and installing the Operating System and all the applications. This tedium is frequently balanced by a fresh demanding challenge which comes along every month or so. Many times though formatting the Hard Drive is the only avenue open after all other efforts to trace the fault have proved fruitless. In the interests of value for money I have a guideline that if no obvious progress is being made within 60 to 90 minutes a fresh start by way of a format is the most prudent approach.

Recently I was faced with an almost new computer that now refused to connect to the Internet. The computer could log onto the clients ISP however there was no e-mail or web Browser functionality. The client, or rather their children had been using the Internet on a daily basis up to now without any problems. As is often the case when children are involved getting the exact run down on what happened or what was done after something happened is difficult so I had no clues as to what software was being used or had been recently installed.

There was however one very strange error message at start up which I had never seen before.

C:\WINDOWS\NEWDOT~3.DLL,NewDotNetStartUp not found

I could remove the error message by deleting the reference to this file from a run key in the registry however this had no effect on the problem and there was no file of the name on the computer.

My normal approach when faced with a computer that fails to connect to the Internet after first checking all the normal settings such as Dialup Networking, TCP/IP and Modem configuration etc is to try another known ISP. This can then isolate fundamental errors such as the clients account at the ISP has been suspended, password is incorrect or similar technical errors. You would be surprised how many problems are caused by incorrect passwords or clients even claiming they had no password!. Many clients fail to pay their accounts and so ultimately their account may get suspended by their ISP.

In this case connecting to my ISP using my personal account also failed to allow any Internet functionality. As was the case using the clients ISP I could connect however no packets of data could be sent or received. The easiest way to test for Internet functionality is to use PING.EXE from a DOS Window. Selecting the DOS Prompt from the start menu and then typing ping ozemail.com.au (or any web address) followed by the ENTER key will send packets of data to the particular site and display the return speed information as below.

C:\WINDOWS>ping ozemail.com.au

Pinging ozemail.com.au [203.2.194.3] with 32 bytes of data:

Reply from 203.2.194.3: bytes=32 time=208ms TTL=238
Reply from 203.2.194.3: bytes=32 time=192ms TTL=238
Reply from 203.2.194.3: bytes=32 time=170ms TTL=238
Reply from 203.2.194.3: bytes=32 time=200ms TTL=238

Ping statistics for 203.2.194.3:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 170ms, Maximum = 208ms, Average = 192ms

If the Computer has not got an effective Internet connection the error message below is displayed.

C:\WINDOWS>ping ozemail.com.au
Unknown host ozemail.com.au

This was the message displayed with the clients computer.

The computer certainly was not infected with a virus. I had been very insistent when I originally setup the computer that the client updates the virus scanner's data files every week and they had done this religiously. As a precaution I did scan the whole Hard Drive with another highly respectable DOS based product as a double check. I mention potential viruses problems as some viruses can prevent effective Internet connections.

I reinstalled Windows 98SE but to no avail. It should be noted that reinstalling the Operating System normally replaces missing and corrupted files and only resets very basic things within the registry. Many faults are left as they are by the reinstallation in the belief that that is the way the user needs them. It would be an unwise person however who did not attempt a quick Windows reinstallation if even in desperation!.

I removed, reinstalled and reset up the Dialup Networking but there was no change.

I tried another Modem but to no avail. I have seen a number of faulty Modems in my time that will connect but lockup as soon as some larger packets of data are sent.

I admitted defeat. I was beaten.

I backup up the data that the clients children had on the Computer, formatted the Hard Drive, installed Windows 98SE, installed all the applications and finally returned the backed up data. Once I had setup the Internet software a quick test proved that I had full Internet functionality again. I was frustrated. All my knowledge and experience had let me down.

The problem had to be in the registry.

As is often the case the client had fiddled with the computer for a few days prior to calling me and any of the automatic registry backups that Windows 98SE makes had been overwritten in that time. I was therefore unable to use a backed up older version of the registry from a time prior to the problem evolving. By default you normally have 5 days of backups available to you to recover from serious registry corruption. To further complicate the issue a kind friend of the client had already reloaded Windows 98SE so a final fall back using system.1st was also not available to me to use. When Windows is installed on the computer a registry file called system.1st is saved on the hard drive in the root directory. This is a copy, although now dated, of the original system.dat which I could have used as a substitute for the corrupted system.dat and maybe corrected the Internet problem. The reinstallation of Windows had substituted a new system.1st with the inherent problems.

The client was happy to get the computer back with the Internet now again available for the children's school studies but I was disappointed.

I could hardly believe it when only a few days had passed and I was called to another computer with exactly the same fault and same error message at start up.

C:\WINDOWS\NEWDOT~3.DLL,NewDotNetStartUp not found

No need to waste time trying to fix this one I said to myself and after ascertaining what data was important to the client I formatted the hard drive and reinstalled everything with the same positive results. This client was even happier as the total time to repair was less than half that of the original computer because I wasted no time in trying to effect a repair based on my recent experience. As this client had also spent an number of days on the phone to their ISP and trying various things there was also no registry backups available prior to the problem developing.

I am not one however to give up easily. If there were two computers with this mysterious problem and error message maybe there was going to be more. I could not go around formatting Hard Drives every time I saw this fault. I needed to be on the trail and so I turned to the Internet and after some considerable time using the major search engines I was able to find only one good web site devoted to this problem

http://www.cexx.org/newnet.htm

My error message was referring to a piece of software from a company called NewDotNet. Interested readers may wish to look this web site at the material available discussing the problems removing this software under some situations. The site has named the offending software Foistware because many times it is loaded on your computer without your knowledge.

The NewDotNet software consists of a Browser "plug-in" DLL which they claimed is surreptitiously bundled with unrelated software. It is run silently at start-up by a Run key placed in the Windows registry. The site claims that the following software may contain versions of the NEWDOT DLL.

Go!Zilla BearShare Mp3.com iMesh Babylon Cydoor Webshots gDivx

Removal via control panel Add/Remove is normally possible however in many cases including the two computers discussed in this article there was no such option and with a web site devoted to its removal there are certainly many others affected as well. I can only speculate that the children in the families involved downloaded some software and subsequently removed it causing the DLL to be removed but the registry settings remained.

The New.Net plug-in is installed as a Layered Service Provider (LSP) under Windows, which makes all Internet requests pass through it. If the program (NEWDOT DLL) is removed, but its LSP entries remain in the registry these requests have nowhere to go and so no Internet access is possible. The basic function of the New.Net application is supposedly to allow direct access to some new Domains the company is promoting. I can not speculate on the functionality of the plug-in however I can caution users against installing software they may have no need for. As a further precaution users should read the license agreement of free software downloaded from the Internet to check if some Foistware or Spyware is also being installed at the same time.

If any reader has this problem at sometime in the future extremely detailed and complicated explanations are offered on this site detailing how to alter and correct the registry entries. The complication for any affected user is that without an effective Internet connection they will be unable to read information on the web site. For the very adventurous users who like to test free software from the Internet maybe a print out of the removal procedure is in order now.

I have printed out the information and presently await the next occurrence of the problem so I can get my registry editing skills to work...