spybot won't remove dso exploit

Quote:

---

Originally Posted by 2cool4skool1983

Hi guys, i have the same problem with dso exploit and spybot. i read the messages posted but dont want to sound stupid cuz am not a techie, is it agreed that changing the registry only hides exploit from showing up? but it doesnt harm my p.c right? -If i can just hide it thats great but where do i download the microsoft updates to keep me in the clear? -oh and by the way, im having another problem with a "common hijacker" -has anyone dealt with this before? -if so could you possibly offer some advice as i am losing hair at a predigious rate. it says "common" but i figure it cant be that common as spybot wont remove it(exactly the same way as with dso exploit) and i cant find anything else to get rid of it with! its a real bastard as it has hijacked my home internet connection (wont let me connect at all let alone click on the icon)and media players etc.. please please help me!

---

Hi All,

Killer advice here. I did the same thing ITguy suggested. Followed Spybot into the registry and changed the file name. I'm not a full fleged geek, so I sweated a bit on the next startup - everything works fine though. (Came here to make sure I wasn't screwing myself.)

I just went through a complete format after doing battle with CoolWWWSearch. It was hijacking my browser and forcing me into some lame homepage. I could never get rid of it and crashed my registry using 3 different apps while trying. I had to put the drive into my buddy's tower to recover some essentials. Here's what I did to avoid that fiasco again. (Some of this might help you 2cool.)

1. After the format, I partitioned my HD into 2 drives. C: is about 10 Gigs, I am using this drive for the OS and any application files. Everything I never want to lose goes on the other "half" of the drive and need never be formatted in an OS related emergency. Also, no .exe files on this part of the drive unless they are part of a .zip file and prescanned for viruses.

2. Check out CNET.com's spyware pack. I use Ad-Aware, Spybot, and Zone Alarm. (I recommend DLing these from the mfg's websites - much quicker.) I check for updates everyday on Ad-Aware and Spybot. XP should check for updates from Microsoft automatically. (If your's isn't 2cool, look on your start menu to do it manually.)

Even after all of that I still had Alexa and DSO Exploit. Spybot got Alexa and I renamed the 1004 files by hand. Looks OK now. I'll keep my fingers crossed.

I hope any of this helps,
Foxy

Hi again,

Here is a fairly specific technical explaination of what Spybot is telling us.
And I quote . . .

"Basically what's happening is that Spybot is finding that the security setting for "Download unsigned ActiveX controls" for the (normally) hidden "My Computer" zone in Internet Explorer is not set to disabled.

Given that anyone who is properly patched (via Windows Update) is not vulnerable to this exploit anymore, this is really not a serious issue, so provided your system is patched, you have nothing to worry about and can just ignore this until the fix comes out.

As to why Spybot isn't fixing it right, and what exactly it is doing when it goes to fix the value, here's a little analysis from testing this a few minutes ago...

Decoding the values displayed:


.\Internet Settings\Zones\0\1004!=W=3


The "\0\" points to the My Computer Zone. The key "1004" holds the value for the specific setting "Download unsigned ActiveX controls". The "!=" means "not equal". "W=3" (word value of 3) specifically means "disabled". Therefore, Spybot is finding that this setting is not disabled for various users defined on the system.

When it actually goes to fix that value, (ie. to simply change whatever it is set to currently to a value of 3), the bug is that it isn't setting it to the proper type of data element - a DWORD value. Therefore, that registry item ends up with no value at all after the fix is performed, and so every time you run a scan again, Spybot still finds that the value in that/those keys is not equal to 3.

As I say, a minor bug that should be fixed soon."

For thems who understand such things.

Welcome to Windrivers Foxy.

Yes sound advice on the splitting up of the hard drive. Something I always do. I also advocate moving temporary internet files, outlook express files and my documents into the data section. That way you don't have a problem digging about trying to find where windows really puts them, makes them easy to back up and if you have to go digging around in command line, you know you don't have to remember incredibly long path names shortened to dos names.

Quote:

---

Originally Posted by ITguy

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

---

Thanks I.T. Guy I agree it's better to disable dso than to simply ignore it. for all non techies, simply cut and paste I.T. guys directions to a text file, log off of the net, open the text file after rebooting, and follow the directions. You also could print them out. Now how hard is that?

Welcome to Windrivers 1petros

Hopefully people won't find it hard.

Quote:

---

Originally Posted by jackpot316

i keep running spybot and it finds a problem ( DSO Exploit 5 entries) and i click fix and go back and scan again and its right back can anyone help on this?

---

After running spybot check and fix, double click DSO EXPLOIT. Entries will appear with long paths, ending with Zones\0\1004 etc.. Double click building blocks on right of screen. Registry files will appear in split screen. If 1004 is highlighted on right screen, delete it. If 1001 is highlighted, DO NOT DELETE!. If 0 is highlighted under zones in left screen, close window and double click the highlighted selection in spybot. Registry screen will appear again, this time 1004 will be highlighted in the right screen. If any other file is highlighted, ignore, close window, then go back to spybot and repeat the process for the next 4 DSO EXPLOIT entries. All 5 entries will be deleted, even if you only deleted 1004 four times. This process works with Windows XP, I don't know if it will work with other versions.

Welcome to Windrivers edpol and thanks for the tip.

http://www.greymagic.com/security/advisories/gm001-ie/

Go there, this site will tell you how to work around this bug that was injected into your directory.

Quote:

---

Originally Posted by jackpot316

i keep running spybot and it finds a problem ( DSO Exploit 5 entries) and i click fix and go back and scan again and its right back can anyone help on this?

---

Hey all, brand new to this forum too. (Found it by searching for DSO Exploit). Just want to say I spent 2 days straight trying to find a way to remove About:Blank (CoolWebSearch).

CWShredder removes it (and also checks for other crap.)

http://www.majorgeeks.com/download4086.html

just download it (free) and run it.

Quote:

---

Originally Posted by PCDummie

Hey all, brand new to this forum too. (Found it by searching for DSO Exploit). Just want to say I spent 2 days straight trying to find a way to remove About:Blank (CoolWebSearch).

CWShredder removes it (and also checks for other crap.)

http://www.majorgeeks.com/download4086.html

just download it (free) and run it.

---

Welcome to WD PCDummie .

So you cleared yours up ?

CWShredder , SpyBot ,Ad-aware and so on , along with instuctions are linked on this page ;
http://forums.windrivers.com/showthread.php?t=57348

I am new to this site. I found it by googling DSO exploit also, and have been struggling with the same problems for the last few weeks, and obsessively last few days.
I discovered that a company named mx-targeting.com had bugged my PC. a Few files named mxtarget were installed in my hard drive I went to the start menu and then searched for mxtarget and deleted those files. It seems to have done the trick. The files I deleted were in the temp, temporary and windows folders.
I hope this is of help.

Welcome to Windrivers hoyanny and thanks for the tip!

I just deleted the registry entries. That was weeks ago and haven't had any problems since, but changing the entry names is a better idea "just in case".

i use spybot and found the famous 5 entries for dso exploit. i disabled my internet link and deleted them and ran spybot again. they reappeared, so there is something else embedded in our computers that automatically re-creates these entries when deleted. i have never edited the registry, but may check that out. has anyone any thoughts on this ?

Quote:

---

Originally Posted by douglas

i use spybot and found the famous 5 entries for dso exploit. i disabled my internet link and deleted them and ran spybot again. they reappeared, so there is something else embedded in our computers that automatically re-creates these entries when deleted. i have never edited the registry, but may check that out. has anyone any thoughts on this ?

---

Welcome to WD douglas .

You can start here ;
http://forums.windrivers.com/showthread.php?t=57348

and do those and wait on touching Registry until need to .

And you can start a new thread if you have questions or problems so you don't get lost in the crowd . :D