Check out some similar questions!

GTX_SlotCar · Jul 23, 2004, 01:08 PM

I've been on vacation for a few days, so please excuse the belated reply.

GTX, it seems like you're defending your position. The problem is, no one is attacking it.

My position was attacked by one person, but I wasn't suggesting that you were doing it also. I was sincere in saying that I'm happy that you found a cure that satisfies you.

]So...
1st, GTX and psi42, which one is it? Do I check to see if IE recreated the key or do I go and recreate it myself? Also, by recreating the key to it's default setting am I setting it to allow the same virus to enter my PC and start this cycle all over?

To the best of my knowledge, Windows will not automatically recreate 1004. It may do it if you change your security settings as each user on your computer, but I don't know. Doing it in the registry is faster and a sure thing. The DSO Exploit is not a virus.
The DSO Exploit would probably create the key if it wasn't there, so that's no protection. If you have all your current Windows updates, you won't get this DSO Exploit again. This door has been closed and can't be exploited again.

]2nd, I have a few viruses that are quarantined by Symantec AntiVirus but that are not showing up during the S&D search.

The programs shouldn't find the same problems. One is anti-virus, the other is anti- adware/spyware/malware.

layray · Jul 24, 2004, 05:59 AM

1. Open the 0 folder
2. In the right pane, right click on 1004 and delete it
3. Right click on the 0 folder and choose New then DWORD Value
4. A new DWORD key will appear named New Value #1. Rename it to 1004 and hit Enter
5. Hit Enter again (or double click 1004) to open your new 1004 DWORD
6. A dialog box will appear. The Name Value at the top will be 1004. On the left is a box to enter a Value data. Place a 3 in this box. On the right is a place to choose the BASE. Make sure hexadecimal is chosen
7. Click OK and close the registry

The next time you run spybot, the problem should be gone, and you don't have to tell spybot to ignore it.

I did this, ran Spybot, and it did not find DSO Exploit anymore :). This is easy fix, just delete one value, and add one. Thanks GTX for the tip.

Katdaddi · Jul 26, 2004, 05:57 PM

I got to this forum because I did a search for "DSO," which is what spybot said I have. I think I effectively removed it following all previous instructions. Thanks. But, my problem still remains... When ever I open IE browser it is hijacked to http://ssearch.biz/?wmid=1010 and I can't use the forward or back buttons. Please help
THANKS IN ADVANCE

GTX_SlotCar · Jul 26, 2004, 07:40 PM

You might want to try running cwshredder which can be found here:
http://www.spywareinfo.com/~merijn/downloads.html

Katdaddi · Jul 26, 2004, 07:55 PM

Thanks GTX. I tried that. No Luck though. I ran a program callede HIJACK THIS and I save the following log. Maybe someone can identify the culprit for me from the list.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0001.1004\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0001.1004\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0001.1004\en-us\msntb.dll (file missing)
O4 - HKLM\.. \Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\.. \Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\.. \RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\.. \Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\.. \Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: AirFortress® Client.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: One-VA VPN Client.lnk.disabled
O4 - Global Startup: RealSecure(r) Desktop Protector.lnk.disabled
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab

Thanks for any help.

ManKilla · Jul 26, 2004, 07:56 PM

All right.. so I just spent the last hour reading all the replies to this DSO Exploit thing and don't have all the answers I need because so many different people have given different ways of fixing it. Can someone please give me answers to the following questions:

1) How can I completely delete it of my computer without harming anything or deleting anything of importance.

2) What is this DSO exploit anyway so many people have asked and there haven't been any answers... does anyone even know how harmful it is to my computer... Ive gone to the link that is apparently supposed to tell you what this thing is and it didn't explain anything.

Thanks ahead of time for the advice and sorry if you have to repeat yourself to tell me how to delete it, its just because I don't know who instructions to follow.

GTX_SlotCar · Jul 27, 2004, 06:22 AM

Katdaddi

Ssearch.biz is a hard one to get rid of.
Try Adware Away at this link:
http://www.adwareaway.com/ssearchbiz.htm

Katdaddi · Jul 27, 2004, 06:40 AM

Thanks GTX. OUTSTANDING. It's gone and browser functions have returned. Truly grateful.

rEEbok1312 · Jul 27, 2004, 03:57 PM

What site can I download spy bot from?

GTX_SlotCar · Jul 27, 2004, 04:14 PM

http://www.safer-networking.org/en/download/index.html

alicka · Jul 28, 2004, 07:42 PM

G'day all~
Well well well... Ok peeps n perps Microsoft have finally brought out some vulnerablity patches, these patches are for the OS security flaws and IE security flaws. That's it, all your problems rectified.

Réδ√röv¿╦ûΓÜ√○b!! ;D ;D ;D

ManKilla · Jul 29, 2004, 06:44 AM

alicka,
So you say the problem can be fixed... awsome but how do I do it... sorry I'm allitle computer slow... so if you could explain that would be awsome. Thnxs! ;D

alicka · Jul 29, 2004, 05:06 PM

Hey matey, yea don't sweat your not slow your just lazy :P hehe, yea all you have to do is go to microsofts patch site and get the cumulative and vulnerablitly patches MS04-022,-023 ,-024. IF you haven't already got IE6 wiv service pack 1a, then plezzzz get it~

Um its not to hard to find the patches but if you do have trouble then get back to me and il show you the exacto mondo spot! Okiely dokiely

Regards~ ;D

Shovelwielder · Jul 31, 2004, 04:21 PM

Wow, THX Cellarius and all the other helpful techies! I fixed the DSO problem, and it seems my computer is going faster than it was a few minutes ago, or I might be hallucinating due to my extreme happiness of getting rid of that darned thing! Thanks again! ;D

katzgirl · Jul 31, 2004, 09:32 PM

THANK YOU "GTX Slotcar"! The information in your posts is priceless. After reading your posts I have a good understanding of DSO Exploit and why SpyBot kept detecting it even after I went through the necessary steps to remove it. After following your easy-to-follow, step-by-step instructions, I now finally receive the SpyBot congratulatory message "no immediate threats found". Thanks for taking the time to post!

dark_tweaker · Aug 4, 2004, 01:15 PM

Hello

Just run spybot s&d, dubble click on the problem, right mouse click on it, then details, go to location, then delete it in the register,

Greetz ::)

alicka · Aug 4, 2004, 09:59 PM

Why didn't I think of that! :o
On the rite track lad, but jumping to location doesn't always take you to the exact file you need to delete.
It usually goes to the last location you were in prior.

esha · Aug 8, 2004, 03:03 PM

Doesn't sudbury's thing just ignore it? How do u GET RID of it?

alicka · Aug 8, 2004, 04:54 PM

Yes, it just ignores it. And hear I thought I was talking a nother language :D. The manual fix is in here, or you can just get the latest Service packs and patches for IE 6 preferably n The OS you are using.

Regards~

Cossack · Aug 10, 2004, 10:59 AM

How are you doin'? 8) I'm new here, but that sure doesn't mean that I'm stupid or annything. I have the DSO problem( if you could call it a problem). OK, so I got Spybot, Ad-aware, McAfee. Well, I'm all good, except when I run Spybot I keep gettin' the 5 DSO Exploit errors. You know. Then I fix 'em, and everythin' is good again. Then the other day I scan again, and I get the DSO's AGAIN, I fix them AGAIN, and everything is good AGAIN. Then the other day, I scan AGAIN, I get DSO's AGAIN... you get the picture ;)
But what I am askin' about is - I DON"T HAVE ANY PROBLEMS with DSO's. I mean, everythin' works fine, I only get the DSO's in SpyBot every time. But that doesn't seem to harm me, you know? Do I still have to go to the registry and fix the problem? And if yes, then please tell me if I am right - I go there and delete the 1004 from those five files? Is that right?
Thanks guys. I really appreciate your help.