You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Download Cloud Antivirus Gratis

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

New.net

 
Threat LevelModerate threatDamageHighDistributionNot widespread

Effects 

New.net has the following effects:

  • It adds a toolbar to the Internet Explorer browser.
  • It allows the DNS system to use new domains extensions, such as .SHOP.
  • It registers itself as LSP (Layered Service Provider) in order to harvest users' information about their connection, such as Internet usage, pages viewed, phone connection details, inventory of the applications installed in the computer, etc.
>

 

Note:

LSP (Layered Service Provider) is a Windows feature that is used to listen to all the TCP/IP traffic taking place between Internet and the applications that are accessing Internet (such as the web browser, the email client, etc.).

Within this structure, a number of programs are specified. Such programs will carry out certain actions over the TCP/IP traffic; for example, it could be specified a computer security program, which analyses the traffic in search for viruses or other threats before transferring it to the final application of the traffic.

However, this structure can also be used by adware and spyware programs, in order to intercept the communication across the Internet, and, what is worse, if they are deleted without taking precautions, the Internet connection will stop working indefinitely.

Infection strategy 

New.net creates a file with a variable name, generally in the Windows directory. This file is a dynamic link library (DLL), called NEWDOTNETx_xx.DLL, where x_xx is the version number.

New.net creates the following entry in the Windows Registry:

  • HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\Run
    New.net Startup = Rundll32 %path%\newdotnetx_xx.dll

    where %path% is the directory where the file with a variable name NEWDOTNETx_xx.DLL has been created; generally, in the Windows directory.
    By creating this entry, New.net ensures that it is run whenever Windows is started.

Means of transmission 

Spyware programs are usually included in free applications downloaded from the Internet. These programs are installed on the affected computer, sometimes without user consent, without warning users that these programs will collect user details.

New.net is usually included in peer-to-peer (P2P) file sharing programs.

Further Details  

New.net is 90,112 bytes in size.

>