____________________________________________
* Moderator's edit *

If you are having trouble regarding the DSO Exploit, please take a look at http://www.pchell.com/support/dsoexploit.shtml. It will answer the most common questions.

Happy holidays,
~psi42

* End edit *

Original text as follows:
____________________________________________


What is a DSO Exploit??

I ran the spybot program on my computer (windows 98 se) One of the things it found was something called DSO Exploit. Says it's a registry change. The path is HKEY-users\default\software\microsoft\windows\current version\internet settings. There's a message about being a security hole in IE allowing websites to execute code.
Can anyone tell me what this means and if I should get rid of it or not? Is this something that's dangerous and that is hurting or messing up my computer?
What happens if I get rid of it?

Thanks

Hi kat555lady,

By all means, let Spybot get rid of it for you, you don't want it on the computer. Have you seen a web page with a name like CoolSearch, or somethng similar? If yes, you will want to download CWShredder from:

http://www.spywareinfo.com/~merijn/cwschronicles.html

Hope this helps!
Whiskey14 :)

Thank you whiskey, I appreciate it.

Kat.

I'm getting the same DSO exploit message after running Spy Bot. I tried to get rid of it. I even ran the Shredder and it still comes back. Does anyone have a fix?

Try downloading Spy Sweeper from:

http://www.webroot.com/wb/products/spysweeper/index.php

Once it's removed, go to Windows Update and download any CRITICAL UPDATE(S) available, also keep the antivirus program up to date.

Hope this helps!
Whiskey14

I've tried both "Spybot - Seach & Destroy" and "Spy Sweeper" in an effort to solve the same problem you have. No luck for me. Any success on your end?

Check out the following site for information:

http://www.annoyances.org/exec/forum/winme/t1075260322

Whiskey14

I'm not evensure what a DSO Exploit even is... can someone tell me please?

Kat.

Hi Kat,

The following site explains:

http://www.nsclean.com/dsostop.html

Hope this helps!
Whiskey14

I finally got rid of DSO Exploit using "Spybot Search & Destroy" with the following method:

Have "Search & Destroy" look for problems the usual way and then (1) highlight one of the "Data source object exploit" items, (2) Right click the highlighted item to bring up the menu list and select "More details", (3) Now click "Jump to location", (4) You are now viewing the Registry and can use the path shown in the Search & Destroy window to get to the key shown, (5) I manually deleted each of 5 keys and no longer have it coming back. I haven't noticed any change in performance so I trust that I did no harm but I am happy not to have the damned thing any more.

I am having the same problems. Using spybot I have come up with a registery file named " Patrick Dugan" can I delete this file using the method suggested by Cellarius without any problems?
Thanks

If all your critical updates are installed you are protected against DSO Exploit and the finding in Spybot is just a nuisance. Eliminate this by doing the following:

1 Open Spybot and select 'advanced' mode.
2 Select 'settings' in the left column.
3 Select 'ignore product' in the left column.
4 Select 'security' tab.
5 Place check mark in box beside DSO Exploit.
6 Close program
7 Open Spybot and run a scan.

You will find that DSO Exploit has been eliminated and if your computer does not harbour any other spyware you will see a congratulatory message.

Thank you for your help! ;D ;D

I'm having the same DSO exploit problem, I've run spybot, fixed the prob, and it still comes back. I followed the steps to get to the registry editor, but I don't understand how to delete the keys using the path in spybot... please help!

Follow the directions that Sudbury suggested. Spy Bot is aware of the problem and will correct it on the next release.
Rodgdog :o

I followed Sudbury's suggestion and the DSO Exploit is gone from my system. But do I now have to unclick the "Advanced Mode" in my Spybot?

No. Leave it as is. ;)

The reason that I ask is that when I switched to the Advanced Mode, a box came up that said that the Advanced Mode offered more options but some of these options might do harm to my system. Do you know what they meant by this?

I believe it means that you are allowed to do more changes in advanced mode that could screw up your system if you are not aware of what you are doing.
Be careful! Ask first if you are not sure.
Rodgdog

Wait! Wouldnt' that just ignore the dso exploits that pop up? It wouldn't read any dso exploits.. it would just ignore them and skip over them and not put them in the list of stuff that is on your computer.
I may be wrong on that.. please tell me if I am

Im confused now. I also have that DSO exploit. After I changed the settings it doesn't pick it up at all. If spybot just ignores the DSO exploit how is that going to help anything? A problem that I picked up at the same time as the DSO exploit is TIBS, which was found by spyware, and it also keeps coming back and ideas on that?

If you are current with your windows updates then you are ALREADY protected from the DOS Exploit.

The reason it keeps showing in Spybot is because of an oversight in the coding of Spybot... it is not checking to see if you have the Windows Update installed, thus falsely reporting a problem.

Sudbury instructions are telling you how to set Spybot to ignore the error.

Way to go! I entered DSO Exploit in Google and got this site. Steps for eradicating DSO exploit were very detailed and easy to follow. Indeed registry edits did get rid of the exploit. Only I was confused to see that I had to remove five 1004 keys from folders 0 through 4 but Alicka says we have to remove 10 files?
I have Lavasoft Ad-Aware and Spybot program and both found different stuff on my computer. Lavasoft kept finding CoolWebSearch and Spybot mostly complained about DSO Exploit. I have hopefully removed both and updated by Win98 from MS webpage.
QUESTION is that should I change my passwords to credit card, bank accounts, stocks, Amazon and all other place I have visited and entered passwords online to get in? I had these two problems for over a week before I finally got rid of them.

Thanks

Good on yer alicka. I came across this site after having grief over DSO Exploit. As all of you say Spybot can't get the bugger out. For weeks I have been trying so thanks again alicka.
Also I have Web Dialer coming up often. I have done the same process on that. Do you think that will keep it off my PC.

I too am cursed with the DSO Exploit thing. I followed all the instructions to get rid of it but when I look in the folders under "0" it wasn't in all of them... 1004 file. I did delete it in two of them but it simply isn't in the other folders . Yet when I do another scan it finds it with three incidents instead of the original five. I've looked over and over again and there is no 1004... what's up with that? Now when I get rid of this thing is this going to get rid of this horrible pornographic site that keeps coming up (no pun intended)?? This is really annoying me terribly. My firewire is on, my Microsoft critical up dates are all fine, new virus definitions, same with not one but three different spy catcher softwares. What more can I do??
Thanks for all help in advance.

Hey sudbury----- great work!! Your process to remove that b--ch dso exploit was quick& easy. KEEP UP THE GOOD WORK!
LHR

I ran spybot to find dso exploit.
I expanded the list, and used spybot app reganalyzer to go to the 1004 entry.  Then I highlighted, hit shift key and delete key simultaneously, and clicked yes to delete to free space, bypassing the recycle bin.  
It is your registry, so wise to back up the registry.  
Anyway, no more problems with dso!

And thanks to Sudbury for how to use advanced tabs!

Alicka, I am sorry to change direction from DSO exploit to CoolWebSearch but I looked in all of Google and can't find a fix that works. I have coolwebsearch Searchx curse on my computer. I deleted MS Java and installed Sun Java, I got all updates for my Win 98 and then I went into registry and deleted a few entries with cool and coolweb in the comment column.
Every time I startup my PC the browser is hijacked, I remove the spyware using AdAware, spybot and CWshredder and it is gone. Next time I start my PC and it's there again! PLEASE HELP!! :(

Quote:

---

If you are having problems in locating the HKEY_USER files to delete ask me! There are approximately 10 files you must remove to get rid of DSO exploit.

---

I am asking for help. There are thousands of files with loooong file names.

Can't seem to find the right one.

Thanks in advance!

Also...

I have Comcast cable connect, and when I click on IE on my desktop, I find that my browser has been hyjacked from the MSN home to here.res://vkkit.dll/index.html#37049

This normally didn't concern me, but know when I click on one of my favorites, it won't take me there. Doesn't matter which one I click on, I am stuck using my AOL, or Mozilla.

How do I get my IE browser back?
Thanks

??
I followed the instructions as far as altering (deleting) those registery keys, using regedit, however, even upon restart of the computer and re running my SpyBot I still see this DSL Exploit. Before deleting registry keys I was getting DSL Exploit 5, afterwards I am getting DSL Exploit 3.

IBM Machine, WIndows XP Pro

All windows updates are totally up to date... Total confusion here... any ideas?

I'm having the same problem. I wiped out the registry codes like the guy said. I got it again this morning, so I wiped out the new registry codes that popped up. I keep getting these porn site pop ups. One is like p****pool (excuse my language) and the other two were like deep-anal.us and teeny site. It gets annoying real fast when I'm trying to work on something and these pages pop up. I've tried to get rid of it with spybot and I used spy sweeper the other day and it didn't help. I need to know if there is anything else I can do to get rid of it.

Yep, me too. I did delete that 1004 file but only found it in two of the five folders. Now it is still there but instead of having five tracers it has three. I was having the same porn sites as you pop up and it's extremely irritating when you have a ten year old standing by you! I would really like to see these idiots go to jail or pay a big fat fine. I down loaded SpywareBlaster and I think that's helping as I haven't had those porno sites pop up the last couple of days. Make sure you also down load the latest up date for Windows that became available on Friday. It's an important security patch and I think that's helping also. However when I do a scan that DSO Exploit is still there.

A Google search brought me here and I want to add my appreciation for this fix. It occurs on ALL our PC's but I sincerely hope this works! Thank you.

Quote:

---

Hi kat555lady,

By all means, let Spybot get rid of it for you, you don't want it on the computer. Have you seen a web page with a name like CoolSearch, or somethng similar? If yes, you will want to download CWShredder from:

http://www.spywareinfo.com/~merijn/cwschronicles.html

Hope this helps!
Whiskey14 :)

---

Tried to access the above site but its dead right now. I was able to download from here: http://www.majorgeeks.com/download4086.html

I have used it before but it hasn't found anything - so far!

So Alicka... what DO you do? This hole that's now in the regetit... how do you fix this?? Was that what this latest patch was that Microsoft made available on Friday. I'm sure they've been aware of this weakness in their operating system for some months now. I am no longer having these porno site come up but the DosExploit thing is still there when I do a scan. I want it gone! Could you walk us through it carefully, step by step and if you've already done it but only found the 1004 file in two of the folders why is that, is there a different file number that needs to be deleted? Thanks as all help is greatly appreciated.

:'(
I am listed as a "newbie" on this site, and I have to say
I am disappointed. The one person listed as an "expert" seems short tempered... VERY VERY smart... but short temptered all the same.

When you tell someone especially a "newbie" to delete things in the registry and they do JUST THAT, you shouldn't come back and type things like

>>>>>>>>>>>> FOCUS>>>>>>>>>>>>>>>>>

That makes "newbies" feel pretty stupid. I THOUGHT this would be a good idea to post a question here
And get help from people who "wanted" to spend time helping others that just 'don't get it'

But I can see that is not the case. I will not be posting here anymore, Im almost afraid to ask another question.

OK right, If no one's noticed yet, the DSO Exploit is caused by microsofts Internet Explorer, one of the most popular yet least secure Internet Browsers avalabel, any way, you stand little chance of getting rid of the DSO Explait (unlees you "locked" your registry and "unlocked" when you wanted to install some thing)... I wonder what the Microsoft Tech support would say if you asked them about it, well any way, if you serach for DSO Exploit on microsoft.com (I mean a full search including every thing) you get 11 results that arnt relevant to the fixing of the DSO Exploit so ither Microsoft don't know it exsists OR they denie it exsists, ither way there a bunch of idots, any way, if Microsoft don't know about it/denie it what chance dose any one have of removing it (Come to think of it, it's almost exacly the same problem with ISS webhosting, Microsoft carnt make it secure, who can? I've said what I wanted to say, now I'm leaving)

Hi,

I feel the same way as Beanie, if you get fed up answering the same questions day in and day out, why not copy and paste it, it makes so much easier.

Remember not everyone knows a lot about computers or anything else for that matter. I'd rather give someone an answer starting with a step one. When you answer questions online, you do NOT know how much the person asking the question knows, they might even be more knowlegable in other areas of computing than you.

Regards,
Whiskey14

I am a newbie and have the same persitent problem. Can DSO Exploit be avoided by using another browser such as Netcaptor or Mozilla? If so, any recommendations? Thanks.