spybot won't remove dso exploit

Quote:

---

Originally Posted by ITguy

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

---

[SIZE=7][COLOR=DarkOrange]
easier said than done but I'll try. meanwhile can you tell me exactly what this threat is?

Quote:

---

Originally Posted by ITguy

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

---

Hi again, I opened regedit and, honestly, at this point, I'm afraid of touching anything! How do I rename the 1004 files?

Quote:

---

Originally Posted by anasteele

Hi again, I opened regedit and, honestly, at this point, I'm afraid of touching anything! How do I rename the 1004 files?

---

Ok, I found the files but I'm not able to modify the 'value name'. Now what?

Welcome to Windrivers anasteele

this answers some of your questions - bet you wish you hadn't asked now!

ok, you right click on the key (not file I know it looks like a file, but it's called a key) and select modify - you will get up a little box to type in the new value - type in 1003 and click ok. Do that for each key. Then close regedit - it automatically saves. You must be logged in as Administrator to do this.

About the DSO exploit issue in SpyBot.

I also have had the above issue and the DSO exploit kept
coming back after I would re-run SpyBot the next time.

Tried everything ... CWShredder, SpyWareBlaster, et al.
and nothing seemed to work to get rid of this annoyance.

Finally got rid of it !!! Right clicked on the registry icon
at the end of the line and then one of the drop down
buttons said "Jump to registry" and all I did was delete
the registry entry ... now it's gone !!!

Monk would be proud of me!!

Welcome to Windrivers awinner.

I think it would be better to wait for the fix from spybot.... deleting the entire key without knowing what it does could cause problems later on.

They are working on a fix, and if your windows updates have been done and are up to date, you need not worry too much about the 1004 entries.

Quote:

---

Originally Posted by NooNoo

Welcome to Windrivers anasteele

this answers some of your questions - bet you wish you hadn't asked now!

ok, you right click on the key (not file I know it looks like a file, but it's called a key) and select modify - you will get up a little box to type in the new value - type in 1003 and click ok. Do that for each key. Then close regedit - it automatically saves. You must be logged in as Administrator to do this.

---

Thanks for helping me whit this matter. I finally did it but I wasn't logged in as an Administrator. I think my PC is going nuts! The main thing is that it worked and after that I ran Spybot and it didn't detect Exploit any more but the Anti-Virus is and it says its cleaning them.

Noo Noo,

Thanks for your response to what I had done
to remove the "DSO exploit" annoyance in SpyBot.

(deleting the registry entry 1004)

I agree with your response that it would be best to wait
till SpyBot comes up with a fix for this rather than take
the risk of deleteing an entry in the registry.

But, since I have 2 computers (one is strictly for presentations
and can act as a backup for the other ... Incidently the other
computer does not have the DSO exploit error) I felt I had the
luxury of seeing if it would work.

So far, having run most of the programs I usually use, I haven't
had a problem ... so far, at least!

Again, appreciate your advice and it certainly would be the most
prudent course to take (waiting for the fix from SpyBot). And not
to risk any attendant problems it could create by changing the
registry entry. That is surely the course I would recommend to
everyone. But, I've always lived my life on the edge and risk
taking s nothing new for me.

Thanks, again

of trying it and seeing if it would work.

anytime

Quote:

---

Originally Posted by ITguy

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

---

[FONT=Arial]

Good Deal ITguy. I followed your instructions to the TEE and "no more DSO Exploit". Anybody that has a problem performing this fix just needs to read the directions very slowly and don`t worry about getting into the Reg. It`s not a problem if you do it exactly as ITguy suggested. I dance with that devil (Registry) often. The only issue I encountered was the HKEY_USERS\S-5-20\
line. You have to follow the path all the way: \Software\Microsoft\Windows\CurrentVersion\Interne tSettings\Zones. Go through everyone of them (0-1-2-3-4) and change the name from 1004 to 1003 wherever you find it. You`ll be glad you did if this things been driving you nuts like everybody else!

Quote:

---

Originally Posted by NooNoo

Welcome to Windrivers anasteele

this answers some of your questions - bet you wish you hadn't asked now!

ok, you right click on the key (not file I know it looks like a file, but it's called a key) and select modify - you will get up a little box to type in the new value - type in 1003 and click ok. Do that for each key. Then close regedit - it automatically saves. You must be logged in as Administrator to do this.

---

Hello NooNoo, I just wanted to clear one matter up. You don`t have to be logged in as an Administrator to do this. Just (as you said) right click the 1004 and click "Rename", then change the highlighted box to 1003 and you`re done. I just didn`t want anybody out there that was already scared to become more so.
Thanks for the info....

Welcome to Windrivers steve.

Well, administrative rights I should have said, if someone has not got adminstrative rights it won't work... and at least they know they have to do something different.

I followed ITguys' advice and it isn't showing up on spybot anymore, but my homepage is still plagued with this wierd search page.

What else can I do?

FC

Quote:

---

Originally Posted by fcpreacher

I followed ITguys' advice and it isn't showing up on spybot anymore, but my homepage is still plagued with this wierd search page.

What else can I do?

FC

---

Welcome to WD fcpreacher .

Did you have a look here ;
http://forums.windrivers.com/showthread.php?t=57348

and follow NooNoo's steps .

And then start a new thread here with a copy & paste of the HiJack log so they can help you finish ridding of the left-overs .

Grettings there from 24/7,
Correct if I am wrong!
But if you choose ignore, would that not be kinda like, bypass. Therefore it would actually, not notify, and not remove it!!

I looked in startup and I don't see it. The registry removal method is true. And really does remove it, although there may be files that are associated with it it, but can not recognize it any longer because of the registry change. And, windows 98 SE and windows me and such are smart enough to make the changes after the registry change to run smoothly.

I tried both sybot versions, or the ones I have, it actually stops the 1.1 version, and version 1.2 does not remove it. (for good, and that is because of the registry entry, it defaults right back on re-boot)

I think it would also help to go to add/remove, and try to remove Internet Explorer, when it comes up and says, internet explorer cannot be removed, choose REPAIR, and that should clear up any associated files with the regisrty change., although if you have the updates from MS, then you may need to update again!

Wav'in at ya from 24/7 Las Vegas, Nevada !:-))