spybot won't remove dso exploit

[jackpot316]

i keep running spybot and it finds a problem ( DSO Exploit 5 entries) and i click fix and go back and scan again and its right back can anyone help on this?

[TripleRLtd]

We need to know what the DSO is for starters. Also, try the other help listed in the "sticky" at the top of AV/Security forum. One more option is to do all of this while in safe mode and check your msconfig to see what is starting up that should not be there.

[jackpot316]

We need to know what the DSO is for starters. Also, try the other help listed in the "sticky" at the top of AV/Security forum. One more option is to do all of this while in safe mode and check your msconfig to see what is starting up that should not be there.

I am stumped on this one. I ran all the programs as you said on my girlfriends comp. And found a few things with spybot, Its saying its (dso exploit 5 entries) So I clicked fix. And did the rest of the stuff, And rebooted and scanned again with spybot. And it was right back, So i went and found that I needed to update windows. And did so and scan again in safe mode with system restore off. And its back again, But with ony 2 entries. IF someone knows of A fix for this problem please let me know i want it off thank you.
this is what i ment to post first sorry i didnt put everything in the first post i did all of that but it keeps comimg back i am running it again will let you know in a sec i am on my pc right now yeap its back and guess what it now has 4 entries not 2 ?

[TripleRLtd]

Tell us the name of this "exploit" Jackpot. Did you check the thread I pointed you to? Do you know about HiJack This as a tool?
http://forums.windrivers.com/showthread.php?t=57348

[jackpot316]

Tell us the name of this "exploit" Jackpot. Did you check the thread I pointed you to? Do you know about HiJack This as a tool?
http://forums.windrivers.com/showthread.php?t=57348

Logfile of HijackThis v1.97.7
Scan saved at 2:31:58 PM, on 5/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Documents and Settings\Owner\My Documents\spybot\SpybotSD.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
O2 - BHO: (no name) - {02478D28-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_0_2_6.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (disabled by BHODemon)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_0_2_6.dll
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yaho...mmapi_0727.dll

[TripleRLtd]

I see the Yahoo Companion and Toolbar. Do you use these? Again, I ask what does SpyBot find that won't remove properly? Otherwise, unless I am missing something, I don't see any real nasties.

[jackpot316]

I see the Yahoo Companion and Toolbar. Do you use these? Again, I ask what does SpyBot find that won't remove properly? Otherwise, unless I am missing something, I don't see any real nasties.

this is what spybot showed me
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Internet Settings\Zones\0\1004!=W=3

[waldo]

I also get the same 5 also, (DSO Exploit 5 entries) Spybot fixes them but they keep reappearing.

[Suddbury]

Spybot will ignore the finding of DSO exploit when you do the following:

Open Spybot and select advanced mode / settings / ignore products / security tab.

Place check mark in each box beside DSO Exploit.

Exit Spybot. Restart Spybot and run a scan.

Providing that there is no other spyware on your computer you will get a congratulatory message informing you that your computer is clean.

[ITguy]

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

[Suddbury]

The solution that I gave for DSO Exploit is quick and easy and does not involve any registry key changes, which a lot of people find intimidating and confusing, and will avoid at all costs. So here again is a easy-to-follow fix that will stop DSO Exploit showing up in Spybot:

1 Open Spybot and select 'advanced' mode
2 Select 'settings' in the left column
3 Select 'ignore products' in the left column
4 Select 'security' tab
5 Place check mark in the box(s) beside DSO Exploit
6 Exit Spybot
7 Restart Spybot and run a scan

Providing that there is no other spyware on your computer, you will get a congratulatory message telling you that all is well, and the nuisance will be eliminated.

Suddbury

[terryq]

The solution that I gave for DSO Exploit is quick and easy and does not involve any registry key changes, which most people find intimidating and confusing, and will avoid at all costs. So here again is a easy-to-follow fix that will stop DSO Exploit showing up in Spybot:

1 Open Spybot and select 'advanced' mode
2 Select 'settings' in the left column
3 Select 'ignore products' in the left column
4 Select 'security' tab
5 Place check mark in the box(s) beside DSO Exploit
6 Exit Spybot
7 Restart Spybot and run a scan

Providing that there is no other spyware on your computer, you will get a congratulatory message telling you that all is well, and the nuisance will be eliminated.

Suddbury

new to this and not a techie. do not want to make registry changes, but the solution you propose simply means that Spy Bot will not alert you to DSO Exploit - it will still be there. I keep finding a web dialer in Spy Bot with DSO Exploit...am I right in thinking that this is dialing some horribly expensive line? Keep removing them, but every time i re-connect to Internet, they re-appear. Have used Adaware, Windows Updates, Norton Anti-Virus, Spyware Blaster, dsostop2...none of these have made any difference. have all IE settings set to maximum (no cookies etc.). however, keep finding that home page is titled 'about:blank' but show unnamed search page, followed by three pop-ups in quick succession that all tell me that I have spyware on my computer. I do not want to follow the links to these pages as I do not trust them. I am at the end of my tether. Can somebody provide a simple (ish) solution?

[Suddbury]

Hi, terryq

You are quite correct in that Spybot is ignoring the finding of DSO Exploit on your computer but the fact that it is still there does not mean that it is a problem. Assurances have been given that, if Microsoft Updates are current and installed, that you are protected, and can safely ignore the exploit finding and wait for Spybot to release a 'fix'

I do not know how you can remedy your other problems since I am not a techie either but I am sure that others will be able to help you.

[terryq]

Hi, terryq

You are quite correct in that Spybot is ignoring the finding of DSO Exploit on your computer but the fact that it is still there does not mean that it is a problem. Assurances have been given that, if Microsoft Updates are current and installed, that you are protected, and can safely ignore the exploit finding and wait for Spybot to release a 'fix'

I do not know how you can remedy your other problems since I am not a techie either but I am sure that others will be able to help you.

thanks for reply. having spent a lovely sunny weekend in front of computer, I understand your solution. I have also (very reluctantly) gone into the registry to solve the other problems...so far, so good.

I must confess, it has been interesting looking at so many techie pages. it feels quite good to have done more with a computer than just use the internet and Word. I might almost consider myself an apprentice geek now!

[2cool4skool1983]

Hi guys, i have the same problem with dso exploit and spybot. i read the messages posted but dont want to sound stupid cuz am not a techie, is it agreed that changing the registry only hides exploit from showing up? but it doesnt harm my p.c right? -If i can just hide it thats great but where do i download the microsoft updates to keep me in the clear? -oh and by the way, im having another problem with a "common hijacker" -has anyone dealt with this before? -if so could you possibly offer some advice as i am losing hair at a predigious rate. it says "common" but i figure it cant be that common as spybot wont remove it(exactly the same way as with dso exploit) and i cant find anything else to get rid of it with! its a real bastard as it has hijacked my home internet connection (wont let me connect at all let alone click on the icon)and media players etc.. please please help me!