-
May 20th, 2004, 11:14 AM
#1
Registered User
spybot won't remove dso exploit
i keep running spybot and it finds a problem ( DSO Exploit 5 entries) and i click fix and go back and scan again and its right back can anyone help on this?
IF YOU DON'T ASK YOU WILL NEVER KNOW.
-
May 20th, 2004, 11:36 AM
#2
Banned
We need to know what the DSO is for starters. Also, try the other help listed in the "sticky" at the top of AV/Security forum. One more option is to do all of this while in safe mode and check your msconfig to see what is starting up that should not be there.
-
May 20th, 2004, 01:24 PM
#3
Registered User
Originally Posted by TripleRLtd
We need to know what the DSO is for starters. Also, try the other help listed in the "sticky" at the top of AV/Security forum. One more option is to do all of this while in safe mode and check your msconfig to see what is starting up that should not be there.
I am stumped on this one. I ran all the programs as you said on my girlfriends comp. And found a few things with spybot, Its saying its (dso exploit 5 entries) So I clicked fix. And did the rest of the stuff, And rebooted and scanned again with spybot. And it was right back, So i went and found that I needed to update windows. And did so and scan again in safe mode with system restore off. And its back again, But with ony 2 entries. IF someone knows of A fix for this problem please let me know i want it off thank you.
this is what i ment to post first sorry i didnt put everything in the first post i did all of that but it keeps comimg back i am running it again will let you know in a sec i am on my pc right now yeap its back and guess what it now has 4 entries not 2 ?
IF YOU DON'T ASK YOU WILL NEVER KNOW.
-
May 20th, 2004, 01:26 PM
#4
Banned
Tell us the name of this "exploit" Jackpot. Did you check the thread I pointed you to? Do you know about HiJack This as a tool?
http://forums.windrivers.com/showthread.php?t=57348
-
May 20th, 2004, 01:39 PM
#5
Registered User
hijack-log
Originally Posted by TripleRLtd
Logfile of HijackThis v1.97.7
Scan saved at 2:31:58 PM, on 5/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Documents and Settings\Owner\My Documents\spybot\SpybotSD.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
O2 - BHO: (no name) - {02478D28-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_0_2_6.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (disabled by BHODemon)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_0_2_6.dll
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yaho...mmapi_0727.dll
IF YOU DON'T ASK YOU WILL NEVER KNOW.
-
May 20th, 2004, 02:05 PM
#6
Banned
I see the Yahoo Companion and Toolbar. Do you use these? Again, I ask what does SpyBot find that won't remove properly? Otherwise, unless I am missing something, I don't see any real nasties.
-
May 20th, 2004, 02:14 PM
#7
Registered User
Originally Posted by TripleRLtd
I see the Yahoo Companion and Toolbar. Do you use these? Again, I ask what does SpyBot find that won't remove properly? Otherwise, unless I am missing something, I don't see any real nasties.
this is what spybot showed me
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Internet Settings\Zones\0\1004!=W=3
IF YOU DON'T ASK YOU WILL NEVER KNOW.
-
May 22nd, 2004, 07:31 PM
#8
Registered User
Include me too!
I also get the same 5 also, (DSO Exploit 5 entries) Spybot fixes them but they keep reappearing.
Last edited by waldo; May 22nd, 2004 at 07:35 PM.
-
May 24th, 2004, 10:06 PM
#9
Removing DSO Exploit
Spybot will ignore the finding of DSO exploit when you do the following:
Open Spybot and select advanced mode / settings / ignore products / security tab.
Place check mark in each box beside DSO Exploit.
Exit Spybot. Restart Spybot and run a scan.
Providing that there is no other spyware on your computer you will get a congratulatory message informing you that your computer is clean.
Last edited by Suddbury; May 24th, 2004 at 10:10 PM.
-
June 5th, 2004, 12:01 PM
#10
Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.
Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?
ITguy
Last edited by ITguy; June 5th, 2004 at 12:19 PM.
-
June 6th, 2004, 07:44 AM
#11
The solution that I gave for DSO Exploit is quick and easy and does not involve any registry key changes, which a lot of people find intimidating and confusing, and will avoid at all costs. So here again is a easy-to-follow fix that will stop DSO Exploit showing up in Spybot:
1 Open Spybot and select 'advanced' mode
2 Select 'settings' in the left column
3 Select 'ignore products' in the left column
4 Select 'security' tab
5 Place check mark in the box(s) beside DSO Exploit
6 Exit Spybot
7 Restart Spybot and run a scan
Providing that there is no other spyware on your computer, you will get a congratulatory message telling you that all is well, and the nuisance will be eliminated.
Suddbury
Last edited by Suddbury; June 6th, 2004 at 04:57 PM.
-
June 6th, 2004, 09:42 AM
#12
Originally Posted by Suddbury
The solution that I gave for DSO Exploit is quick and easy and does not involve any registry key changes, which most people find intimidating and confusing, and will avoid at all costs. So here again is a easy-to-follow fix that will stop DSO Exploit showing up in Spybot:
1 Open Spybot and select 'advanced' mode
2 Select 'settings' in the left column
3 Select 'ignore products' in the left column
4 Select 'security' tab
5 Place check mark in the box(s) beside DSO Exploit
6 Exit Spybot
7 Restart Spybot and run a scan
Providing that there is no other spyware on your computer, you will get a congratulatory message telling you that all is well, and the nuisance will be eliminated.
Suddbury
new to this and not a techie. do not want to make registry changes, but the solution you propose simply means that Spy Bot will not alert you to DSO Exploit - it will still be there. I keep finding a web dialer in Spy Bot with DSO Exploit...am I right in thinking that this is dialing some horribly expensive line? Keep removing them, but every time i re-connect to Internet, they re-appear. Have used Adaware, Windows Updates, Norton Anti-Virus, Spyware Blaster, dsostop2...none of these have made any difference. have all IE settings set to maximum (no cookies etc.). however, keep finding that home page is titled 'about:blank' but show unnamed search page, followed by three pop-ups in quick succession that all tell me that I have spyware on my computer. I do not want to follow the links to these pages as I do not trust them. I am at the end of my tether. Can somebody provide a simple (ish) solution?
-
June 6th, 2004, 02:03 PM
#13
Hi, terryq
You are quite correct in that Spybot is ignoring the finding of DSO Exploit on your computer but the fact that it is still there does not mean that it is a problem. Assurances have been given that, if Microsoft Updates are current and installed, that you are protected, and can safely ignore the exploit finding and wait for Spybot to release a 'fix'
I do not know how you can remedy your other problems since I am not a techie either but I am sure that others will be able to help you.
-
June 7th, 2004, 06:28 AM
#14
Originally Posted by Suddbury
Hi, terryq
You are quite correct in that Spybot is ignoring the finding of DSO Exploit on your computer but the fact that it is still there does not mean that it is a problem. Assurances have been given that, if Microsoft Updates are current and installed, that you are protected, and can safely ignore the exploit finding and wait for Spybot to release a 'fix'
I do not know how you can remedy your other problems since I am not a techie either but I am sure that others will be able to help you.
thanks for reply. having spent a lovely sunny weekend in front of computer, I understand your solution. I have also (very reluctantly) gone into the registry to solve the other problems...so far, so good.
I must confess, it has been interesting looking at so many techie pages. it feels quite good to have done more with a computer than just use the internet and Word. I might almost consider myself an apprentice geek now!
-
June 10th, 2004, 05:11 AM
#15
i have the same problem
Hi guys, i have the same problem with dso exploit and spybot. i read the messages posted but dont want to sound stupid cuz am not a techie, is it agreed that changing the registry only hides exploit from showing up? but it doesnt harm my p.c right? -If i can just hide it thats great but where do i download the microsoft updates to keep me in the clear? -oh and by the way, im having another problem with a "common hijacker" -has anyone dealt with this before? -if so could you possibly offer some advice as i am losing hair at a predigious rate. it says "common" but i figure it cant be that common as spybot wont remove it(exactly the same way as with dso exploit) and i cant find anything else to get rid of it with! its a real bastard as it has hijacked my home internet connection (wont let me connect at all let alone click on the icon)and media players etc.. please please help me!
Similar Threads
-
By vapd in forum BIOS/Motherboard Drivers
Replies: 3
Last Post: May 8th, 2002, 02:46 PM
-
By Social Enemy in forum Tech-To-Tech
Replies: 3
Last Post: December 26th, 2001, 11:32 AM
-
By Combatroy in forum Tech-To-Tech
Replies: 10
Last Post: September 18th, 2001, 12:50 AM
-
By Worldsci in forum Windows NT/2000
Replies: 1
Last Post: September 10th, 2001, 06:51 AM
-
By littlerumper in forum Tech-To-Tech
Replies: 6
Last Post: August 17th, 2001, 04:15 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Bookmarks