Ask Leo! by Leo A. Notenboom

What's a 'DSO exploit' and how do I get rid of it?

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Viruses and Malware

Comments

Read the article that everyone's commenting on.
RSS feed Subscribe to the RSS Feed for comments on this article.

Comment Page:  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9 

Definitely sounds like spyware. I'd try another spyware program like Microsoft's AntiSpyware scanner.

Posted by: Leo at July 2, 2005 8:43 PM

try this:

http://www.pchell.com/support/dsoexploit.shtml

Posted by: bubba at August 25, 2005 1:47 PM

I have many protections on my computer, they are: Spybot search&destroy
Spyware Blaster
Microsofts antispyware beta
Adaware
Winpatrol
Spyware doctor
All of these programs are kept updated. A few days ago my browser became hijacked, so I ran several scans and discovered a nasty trojan and a variant of cws. Worse thing is they keep returning. I have my windows updates turned on, so I should be up to date. During a routine scan Dso exploit came up.
Can you help me?

Posted by: Rich E at August 25, 2005 8:02 PM

get someone help me get rid of this plz:

Dialer:dialer.bjp No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\ARCHIVIOSEX.NET
Dialer:dialer.akd No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\SGRUNT.BIZ .

ive used the following programs to get rid of them with no luck:

Search and destroy
Spyware doctor
ad-adware se personal
spywareblaster

and yet i still have these dialers!!! im usuing Panda active scan
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

and it keeps telling me i have these two dialers... plz help!

Posted by: Chris.g at August 26, 2005 8:27 PM

Dso canot be removed with spyware programs.the reason is that it comes with a Dll.
you must edit the regestry. henkey users/software
microsoft/internet settings/ zones.


if you leave dso in your registry you may begin
have a problem with your internet.Spybot will find
dso but will not remove it.Dso may remain on a
disk that you may copyfrom a program.

Posted by: John Susi at September 14, 2005 8:05 AM

dso found by spybot. dso shown up by McAfee.. but ist still ther in zipped files. Anyone knopw if I can put them thru the McAfee shredder with a hope of success Or will it hide them and let them operate

Posted by: Duffy at November 21, 2005 10:21 AM

I've followed the directions for updating the registry to fix the DSO Exploit problem, and yet the Exploit continues to return. It hasn't worked for me. Exploit continues to cause IE to attempt to connect at start-up. Any other suggestions?

Posted by: matt at November 22, 2005 3:14 AM

1) Make a note of the location of the exploit shown in Spybot, something similar to:
HKEY_USERS\S-1-5-21-1614895754-73586283-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
2) Click on Start, Run, and type REGEDIT and Press Enter to open the Windows Registry Editor
3) Find the location of the exploit above in the registry by clicking on the pluses(+) next to each title
4) After opening the Zones section and clicking on '0' look to the right window, under 'name' is the key '1004' and the type is REG_SZ simply right click and delete this REG_SZ value.Then right click and create new>DWORD Value, name it 1004, then right click on that and goto modify, give it the Hex Value of 3, Click ok.
If there is only a DWORD Value for the key (in this case 1004), then double click on the key and change the HEX value to 3 and click Ok.
5) Close the Registry Editor and Reboot your computer
6) The DSO Exploit should now be removed and it should no longer appear in the Spybot Search and Destroy log as a problem.

Posted by: Harborsidefx at December 16, 2005 11:43 AM

I have found DSO Exploit does prevent certain Web pages from loading - eg Oracle Forms applications (doesn't affect Mozilla Firefox).

Going to try editing the registry - is this going to remove DSO exploit for good (Spybot removes it but it returns)

Posted by: Neil at April 23, 2007 7:47 AM
Comment Page:  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9 
Read the article that everyone's commenting on.
RSS feed Subscribe to the RSS Feed for comments on this article.
Post a Comment

To post a comment on "What's a 'DSO exploit' and how do I get rid of it?", please return to that article's main page.

Question? Ask Leo!