spybot won't remove dso exploit

[Tr!une]

I've had my laptop for two weeks now and for the last few days the internet has been running slowly, often hanging, and randomly re-directing to porn sites. This is despite having all the most recent updates of windows (I'm running XP) and virus checks, Spybot etc.

Anyway, we've got rid of everything we've been alerted to apart from this 'DSO exploit' so it means that it's this causing all my problems. Liam

I wouldn't say the DSO exploit is causing your problems on that. If you had the coolsearch spyware, that is the likely culprit. This has been one of the hardest bugs to remove in my experience. Here has been my fix.

After running SB and Adaware, all would seem fine until the user went on the web and clicked a few times. XXX sites started popping up. Only thing I could find was a strange .exe in the Registry RUN location. Located the file and the properties added to the suspicion. So I deleted, removed from Registry. Problem still exist and the file would recreate itself when I deleted it. Finally in safe mode I renamed the file from ????.exe to ????.ex_ and success. It didn't recreate itself.

That has happened on about 3 XP machines I have cleaned. All of them had Coolsearch spyware as the common theme.

But NooNoo's suggestion to do a system restore maybe easier at this point.

[Jaz]

thanks for reply. having spent a lovely sunny weekend in front of computer, I understand your solution. I have also (very reluctantly) gone into the registry to solve the other problems...so far, so good.

I must confess, it has been interesting looking at so many techie pages. it feels quite good to have done more with a computer than just use the internet and Word. I might almost consider myself an apprentice geek now!

Hi Terry,
I also have exactly the same problem you described,with my IE page appearing as "about:blank" no matter how many times I reset my preferred homepage, numerous pop-up messages stating that i have spyware on my pc.. and Spybot claiming that I have web dialer and DSO Exploit on my pc.. I remove them and do a clean scan only for them to show up again.
There's a lot of talk about removing DSO Exploit.. what is it exactly? And I"ve looked in pages about Web Dialer and apparently it's a system whereby the inflicted victim's internet account dials up an international number and is charged similar to a 900 phone account ending up with hefty phone bills.
Have you figured out how to clear the DSO Exploit AND web dialer? I'm in no way a techie so would appreciate any simple tips you have!
I have also downloaded a lot of anti-virus & anti-spyware programmes, such as:
AVG
Ad-Aware
Spyware Guard
Spyware Doctor
Spybot
Kerio Personal Firewall
..and it's only Spybot which pick up on DSO Exploit & web dialer..
Do you think that maybe the two are connected with Spybot??

Cheers,
Jaz

[TripleRLtd]

Welcome to WD jaz.
No I don't think so.
Do this: go to the following link and try ALL the suggestions first, as you have done already for the most part, but, after you have done ALL of this, come back and start a new thread with a log of your HiJack This! Then we can help more.:
http://forums.windrivers.com/showpos...64&postcount=1
Also, something that should be included in that link that is not yet: after the downloads, do it in SAFE mode.
Then get back to us with the HJ log.
Good luck.

[Jaz]

Welcome to WD jaz.
No I don't think so.
Do this: go to the following link and try ALL the suggestions first, as you have done already for the most part, but, after you have done ALL of this, come back and start a new thread with a log of your HiJack This! Then we can help more.:
http://forums.windrivers.com/showpos...64&postcount=1
Also, something that should be included in that link that is not yet: after the downloads, do it in SAFE mode.
Then get back to us with the HJ log.
Good luck.

Thanks for all your help TripleR..
I"m just a bit hesitant about all the updating downloads in case that web dialer is dialing up some expensive bill to my internet line! (I'm typing this on a friends computer just in case!).
And also what bit should i be doing in Safe Mode?

Will start the updating of the virus/spyware checkers now.

Thanks, Jaz

[Jaz]

Welcome to WD jaz.
No I don't think so.
Do this: go to the following link and try ALL the suggestions first, as you have done already for the most part, but, after you have done ALL of this, come back and start a new thread with a log of your HiJack This! Then we can help more.:
http://forums.windrivers.com/showpos...64&postcount=1
Also, something that should be included in that link that is not yet: after the downloads, do it in SAFE mode.
Then get back to us with the HJ log.
Good luck.

Here's the Hijack This log.. also currently downloading spyware blaster which failed first time around.. Hope this log makes sense to you!
Cheers, Jaz

Logfile of HijackThis v1.97.7
Scan saved at 3:58:10 p.m., on 24/06/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\WINNT\Explorer.exe
C:\WINNT\System32\WF2K.EXE
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINNT\loadqm.exe
C:\Program Files\Excite\PrvtMsgr\bin\x8IMPipe.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Excite\PrvtMsgr\bin\x8SkPlay.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG6\AVGCC32.EXE
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\DESKTOP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {09D62756-4725-4905-9A0A-84E1E667DDF6} - C:\WINNT\System32\fpjmo.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Excite Private Messenger Pipe] C:\Program Files\Excite\PrvtMsgr\bin\x8IMPipe.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Excite Community Tools Notifier] "C:\Program Files\Excite\PrvtMsgr\bin\x8SkPlay.exe" Notifier
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {C3D96A02-EEA7-4264-98D7-D882A7338DE5} (Excite Installer Start) - http://imgfarm.com/images/nocache/co...tup1.0.0.4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{50D06032-8F9F-4187-ABAD-434748ADFD5F}: NameServer = 202.27.158.40 202.27.184.3

[GrandDad]

Hey jaz , if you need to use your PC to update the programs just unplug the phone cord before you start it up and when your ready to Dial-up plug it back in , you'll know if yours dials or the dialer , (those dialers normal only try to dial out randomly or every so often) .

[Talonboy]

same problem guys, i have the about blank IE problem , i did this

uninstall any mis programs
all temp folders
reg scan

Used

NoAdware
Ad-aware 6
Spy bot
hijackthis
BHOdemon
regcleaner
spy sweeper

updated norton ran that. also all windows files uptodate as well as all programs upto date , I CANT GET RID OF THIS !! i also deleted all my extra tool bars which i thought might cause this. here is my hijackthis log and that search blank in included but keeps comign back.

Logfile of HijackThis v1.97.7
Scan saved at 12:01:38 AM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Desktop Calendar\Desktop Calendar.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ghost\Desktop\HijackThis.exe
C:\Documents and Settings\Ghost\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Ghost\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {4F3F0DF2-9940-4616-9D09-1624800A6CDC} - C:\WINDOWS\System32\jke.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Desktop Calendar] C:\Program Files\Desktop Calendar\Desktop Calendar.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...991.8568865741
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yaho...opper1_1us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab

[Jaz]

I also had this come up on the BHODemon check. Not sure if it means anything..

fpjmo.dll
{09D62756-4725-4905-9A0A-84E1E667DDF6}

dlprotect.dll
{4A368E80-174F-4872-96B5-0B27DDD11DB2}

SDHelper.dll
{53707962-6F74-2D53-2644-206D7942484F}

NavShExt.dll
{BDF3E430-B101-42AD-A544-FADC6B084872}

[Talonboy]

i think that i foudn out the problem guys, this just worked for me. Boot into safe mode. Find these two files , SDhelper and also jke.dll , delete them both in safe mode it will not allow you too in normal mode. i also tried to find it in task manager with no luck . Anyway deleted both of these and you should be good to go. When you first load IE it comes up blank. I gave it a homepage shut it down restarted it and it was good to go (remember homepage)

[Jaz]

Hi Talonboy..

I've also got SDhelper listed on my log but isn't that part of Spybot?

So essentially might that just be the part of Spybot which picks up the spyware/malware/whateverware??
Cheers, Jaz

[NooNoo]

Here's the Hijack This log..

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank
O2 - BHO: (no name) - {09D62756-4725-4905-9A0A-84E1E667DDF6} - C:\WINNT\System32\fpjmo.dll
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

Have hijack this fix these entries, reboot to safe mode (press f8 at startup) and go and find and delete the filenames - eg fpjmo.dll

You will probably need to uninstall yahoo and excite first and turn off system restore.

You were also asked to put your hijack log in a new thread so that we did not have confusion over who's log is whos. Next time, please do so.

[NooNoo]

i think that i foudn out the problem guys, this just worked for me. Boot into safe mode. Find these two files , SDhelper and also jke.dll , delete them both in safe mode it will not allow you too in normal mode. i also tried to find it in task manager with no luck . Anyway deleted both of these and you should be good to go. When you first load IE it comes up blank. I gave it a homepage shut it down restarted it and it was good to go (remember homepage)

SDhelper is part of spybot... jke.dll would be the culprit I imagine... never heard of it.

[Talonboy]

well whatever it is , It's backkkkkkkkkkkkkkkkkkkkkkk

[texomabus]

Instead of telling Spybot to ignore the DSO exploit, use the information Spybot gives you and get rid of it.

Disconnect your internet, reboot your computer (you don't have to go into safemode to do this just boot normally), run Spybot. Go into the registry by going to the start menu then run, type in the word regedit and hit the OK button. Now locate one by one all the registy entries that Spybot said it found the DSO exploit in. Rename the 1004 files to 1003 then exit regedit. Shut down your computer. Plug your computer back into the internet, and restart your computer. Run Spybot again and you will see it is no longer there. Congratulations it gone. pretty simple huh?

ITguy

I am new to this form but want to thank you for your help with dso. I followed your instructions and it was simple and painless.
thanks again!!!

[NooNoo]

Welcome to Windrivers texomabus. Glad you found the forum helpful.