Hey Brad,
Have a look at this: does it fit the bill?
NewDotNet
The NewDotNet software is bundled with a browser plug-in
DLL newdotnetX_XX.dll (X indicates version numbers). The
file is placed in C:\Windows\ or C:\WinNT\ and is run at
start-up via Rundll32.exe by a Run key
rundll32 C:\WINDOWS\NEWDOT~1.DLL,NewDotNetStartUp
which is placed in the Windows registry. The NewDotNet
client transmits a unique ID string when checking the
New.net server for updates and when checking in with the
Firstlook search portal. It promotes New.net's PPC search
engine Firstlook.com, by displaying popup ads on a timer.
The NewDotNet client is also needed to serve subdomains
(.shop, .xxx, .club, .ltd, .inc, .travel, .tech, .sport, .f
amily, .law, .med, .mp3) sold by New.net as root domains -
which they're not.
The program is known to be installed by KaZAa, Earthlink,
@Home ComCast, Juno, Webshots, NetZero, AudioGalaxy,
Bearshare and a host of other programs and web sites.
Removal:
Do not delete the DLL, as it tampers with the default
Winsock settings and manual removal will damage your
Internet access capability. More details on safe removal
of this spyware agent can be found at:
http://www.cexx.org/newnet.htm
http://www.viendez.com/forum.asp?Article=302
There is an uninstaller and install instructions on the
NewDotNet web site. They do not allow (lawyer crazy)
anyone to distribute, mirror or link to their web page
with the uninstaller. Aren't they the sunshine in your
life?
Let me know if that helps.
Bob
NOTE: the NewDotNet DLL cannot be properly removed by some
spyware cleaner versions!!