[Decotey]

Im confused now. I also have that DSO exploit. After I changed the settings it doesn't pick it up at all. If spybot just ignores the DSO exploit how is that going to help anything? A problem that I picked up at the same time as the DSO exploit is TIBS, which was found by spyware, and it also keeps coming back and ideas on that?

[Huntress]

If you are current with your windows updates then you are ALREADY protected from the DOS Exploit.

The reason it keeps showing in Spybot is because of an oversight in the coding of Spybot... it is not checking to see if you have the Windows Update installed, thus falsely reporting a problem.

Sudbury instructions are telling you how to set Spybot to ignore the error.

[Novice]

Way to go! I entered DSO Exploit in Google and got this site. Steps for eradicating DSO exploit were very detailed and easy to follow. Indeed registry edits did get rid of the exploit. Only I was confused to see that I had to remove five 1004 keys from folders 0 through 4 but Alicka says we have to remove 10 files?
I have Lavasoft Ad-Aware and Spybot program and both found different stuff on my computer. Lavasoft kept finding CoolWebSearch and Spybot mostly complained about DSO Exploit. I have hopefully removed both and updated by Win98 from MS webpage.
QUESTION is that should I change my passwords to credit card, bank accounts, stocks, Amazon and all other place I have visited and entered passwords online to get in? I had these two problems for over a week before I finally got rid of them.

Thanks

[nelly]

Good on yer alicka. I came across this site after having grief over DSO Exploit. As all of you say Spybot can't get the bugger out. For weeks I have been trying so thanks again alicka.
Also I have Web Dialer coming up often. I have done the same process on that. Do you think that will keep it off my PC.

[sweetetcher]

I too am cursed with the DSO Exploit thing. I followed all the instructions to get rid of it but when I look in the folders under "0" it wasn't in all of them... 1004 file. I did delete it in two of them but it simply isn't in the other folders . Yet when I do another scan it finds it with three incidents instead of the original five. I've looked over and over again and there is no 1004... what's up with that? Now when I get rid of this thing is this going to get rid of this horrible pornographic site that keeps coming up (no pun intended)?? This is really annoying me terribly. My firewire is on, my Microsoft critical up dates are all fine, new virus definitions, same with not one but three different spy catcher softwares. What more can I do??
Thanks for all help in advance.

[lairhillrocker]

Hey sudbury----- great work!! Your process to remove that b--ch dso exploit was quick& easy. KEEP UP THE GOOD WORK!
LHR

[newawr]

I ran spybot to find dso exploit.
I expanded the list, and used spybot app reganalyzer to go to the 1004 entry.  Then I highlighted, hit shift key and delete key simultaneously, and clicked yes to delete to free space, bypassing the recycle bin.  
It is your registry, so wise to back up the registry.  
Anyway, no more problems with dso!

And thanks to Sudbury for how to use advanced tabs!

[Novice]

Alicka, I am sorry to change direction from DSO exploit to CoolWebSearch but I looked in all of Google and can't find a fix that works. I have coolwebsearch Searchx curse on my computer. I deleted MS Java and installed Sun Java, I got all updates for my Win 98 and then I went into registry and deleted a few entries with cool and coolweb in the comment column.
Every time I startup my PC the browser is hijacked, I remove the spyware using AdAware, spybot and CWshredder and it is gone. Next time I start my PC and it's there again! PLEASE HELP!! :(

[Notpil22]

If you are having problems in locating the HKEY_USER files to delete ask me! There are approximately 10 files you must remove to get rid of DSO exploit.

I am asking for help. There are thousands of files with loooong file names.

Can't seem to find the right one.

Thanks in advance!

[Notpil22]

Also...

I have Comcast cable connect, and when I click on IE on my desktop, I find that my browser has been hyjacked from the MSN home to here.res://vkkit.dll/index.html#37049

This normally didn't concern me, but know when I click on one of my favorites, it won't take me there. Doesn't matter which one I click on, I am stuck using my AOL, or Mozilla.

How do I get my IE browser back?
Thanks

[beanie]

??
I followed the instructions as far as altering (deleting) those registery keys, using regedit, however, even upon restart of the computer and re running my SpyBot I still see this DSL Exploit. Before deleting registry keys I was getting DSL Exploit 5, afterwards I am getting DSL Exploit 3.

IBM Machine, WIndows XP Pro

All windows updates are totally up to date... Total confusion here... any ideas?

[mrperfect303]

I'm having the same problem. I wiped out the registry codes like the guy said. I got it again this morning, so I wiped out the new registry codes that popped up. I keep getting these porn site pop ups. One is like p****pool (excuse my language) and the other two were like deep-anal.us and teeny site. It gets annoying real fast when I'm trying to work on something and these pages pop up. I've tried to get rid of it with spybot and I used spy sweeper the other day and it didn't help. I need to know if there is anything else I can do to get rid of it.

[sweetetcher]

Yep, me too. I did delete that 1004 file but only found it in two of the five folders. Now it is still there but instead of having five tracers it has three. I was having the same porn sites as you pop up and it's extremely irritating when you have a ten year old standing by you! I would really like to see these idiots go to jail or pay a big fat fine. I down loaded SpywareBlaster and I think that's helping as I haven't had those porno sites pop up the last couple of days. Make sure you also down load the latest up date for Windows that became available on Friday. It's an important security patch and I think that's helping also. However when I do a scan that DSO Exploit is still there.

[zettler]

A Google search brought me here and I want to add my appreciation for this fix. It occurs on ALL our PC's but I sincerely hope this works! Thank you.

[zettler]

Hi kat555lady,

By all means, let Spybot get rid of it for you, you don't want it on the computer. Have you seen a web page with a name like CoolSearch, or somethng similar? If yes, you will want to download CWShredder from:

http://www.spywareinfo.com/~merijn/cwschronicles.html

Hope this helps!
Whiskey14 :)

Tried to access the above site but its dead right now. I was able to download from here: http://www.majorgeeks.com/download4086.html

I have used it before but it hasn't found anything - so far!

[sweetetcher]

So Alicka... what DO you do? This hole that's now in the regetit... how do you fix this?? Was that what this latest patch was that Microsoft made available on Friday. I'm sure they've been aware of this weakness in their operating system for some months now. I am no longer having these porno site come up but the DosExploit thing is still there when I do a scan. I want it gone! Could you walk us through it carefully, step by step and if you've already done it but only found the 1004 file in two of the folders why is that, is there a different file number that needs to be deleted? Thanks as all help is greatly appreciated.

[beanie]

:'(
I am listed as a "newbie" on this site, and I have to say
I am disappointed. The one person listed as an "expert" seems short tempered... VERY VERY smart... but short temptered all the same.

When you tell someone especially a "newbie" to delete things in the registry and they do JUST THAT, you shouldn't come back and type things like

>>>>>>>>>>>> FOCUS>>>>>>>>>>>>>>>>>

That makes "newbies" feel pretty stupid. I THOUGHT this would be a good idea to post a question here
And get help from people who "wanted" to spend time helping others that just 'don't get it'

But I can see that is not the case. I will not be posting here anymore, Im almost afraid to ask another question.

[Sparda]

OK right, If no one's noticed yet, the DSO Exploit is caused by microsofts Internet Explorer, one of the most popular yet least secure Internet Browsers avalabel, any way, you stand little chance of getting rid of the DSO Explait (unlees you "locked" your registry and "unlocked" when you wanted to install some thing)... I wonder what the Microsoft Tech support would say if you asked them about it, well any way, if you serach for DSO Exploit on microsoft.com (I mean a full search including every thing) you get 11 results that arnt relevant to the fixing of the DSO Exploit so ither Microsoft don't know it exsists OR they denie it exsists, ither way there a bunch of idots, any way, if Microsoft don't know about it/denie it what chance dose any one have of removing it (Come to think of it, it's almost exacly the same problem with ISS webhosting, Microsoft carnt make it secure, who can? I've said what I wanted to say, now I'm leaving)

[Whiskey14]

Hi,

I feel the same way as Beanie, if you get fed up answering the same questions day in and day out, why not copy and paste it, it makes so much easier.

Remember not everyone knows a lot about computers or anything else for that matter. I'd rather give someone an answer starting with a step one. When you answer questions online, you do NOT know how much the person asking the question knows, they might even be more knowlegable in other areas of computing than you.

Regards,
Whiskey14

[Runner]

I am a newbie and have the same persitent problem. Can DSO Exploit be avoided by using another browser such as Netcaptor or Mozilla? If so, any recommendations? Thanks.