Ask Leo!

What's a 'DSO exploit' and how do I get rid of it?

Home » Viruses and Malware

Summary: A 'DSO exploit' is a bug in IE that might possibly allow untrusted software to run. Make sure you're up-to-date and you should be safe.

What's a 'DSO exploit' and how do I get rid of it?

The short answer: it's a bug in Internet Explorer that could under certain circumstances allow untrusted software to run. In other words, it's a vulnerability. The good news is that it's been fixed.

The confusion arises from the fact that at least on popular Spyware detection program reports the problem, but fails to apply its work around, and hence continually reports the problem. Even though it might not be a problem any more. (Update: that program has reportedly been fixed. See below.)

First, let's be clear. The vulnerability in Internet Explorer has been corrected. If you've patched IE and are staying up to date with current patches from Microsoft, you're safe, even if a DSO exploit is reported.

The confusion arises from a bug in Spybot Search and Destroy that continues to report the DSO Exploit problem, anyway. There are ways to force the report to go away, but it's more trouble than it's worth.

The bottom line: If you're fully up-to-date on Internet Explorer patches, you can safely ignore Spybot's report of a DSO Exploit. And update Spybot from time to time as well; they do plan to fix the reporting problem.

UPDATE: Spybot Search and Destroy has reportedly been fixed. My recommendation now is to download the latest version, and make sure you have it update its database of spyware to check prior to your next scan. It's possible that it may report DSO exploit once, but if you elect to fix it, then the report should go away on your next scan. I can confirm that it no longer reports DSO exploit on my system.

And remember, as long as you were up-to-date with Internet Explorer patches, DSO exploit was not an issue for you, regardless of what the scanner said.

Related:

Article 395 | Posted July 23, 2004

Recent Comments

i have spybot updated and there is nothong that removes the blue tool bar at the bottom of my screen, it appears every time i open internet explorer and the bar doesn't respond anymore.
--> i'll describe it to u so u can see if u've seen it before : there is 6 links : 1.Make Money,2.Music,3.Casino,4.Investing,5.Travel,6.Mortgage, then 6 scroll bar -->DAting,Travel , Careeres, Credit, Computer and insurance. After, there is a search space were u can write somthing. It has the skin of Windows XP and the little 'x' to close the window is inactive... Can someone help?

Posted by: Thierry at July 2, 2005 09:46 AM

Definitely sounds like spyware. I'd try another spyware program like Microsoft's AntiSpyware scanner.

Posted by: Leo at July 2, 2005 08:43 PM

try this:

http://www.pchell.com/support/dsoexploit.shtml

Posted by: bubba at August 25, 2005 01:47 PM

I have many protections on my computer, they are: Spybot search&destroy
Spyware Blaster
Microsofts antispyware beta
Adaware
Winpatrol
Spyware doctor
All of these programs are kept updated. A few days ago my browser became hijacked, so I ran several scans and discovered a nasty trojan and a variant of cws. Worse thing is they keep returning. I have my windows updates turned on, so I should be up to date. During a routine scan Dso exploit came up.
Can you help me?

Posted by: Rich E at August 25, 2005 08:02 PM

get someone help me get rid of this plz:

Dialer:dialer.bjp No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\ARCHIVIOSEX.NET
Dialer:dialer.akd No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\SGRUNT.BIZ .

ive used the following programs to get rid of them with no luck:

Search and destroy
Spyware doctor
ad-adware se personal
spywareblaster

and yet i still have these dialers!!! im usuing Panda active scan
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

and it keeps telling me i have these two dialers... plz help!

Posted by: Chris.g at August 26, 2005 08:27 PM

Dso canot be removed with spyware programs.the reason is that it comes with a Dll.
you must edit the regestry. henkey users/software
microsoft/internet settings/ zones.


if you leave dso in your registry you may begin
have a problem with your internet.Spybot will find
dso but will not remove it.Dso may remain on a
disk that you may copyfrom a program.

Posted by: John Susi at September 14, 2005 08:05 AM

dso found by spybot. dso shown up by McAfee.. but ist still ther in zipped files. Anyone knopw if I can put them thru the McAfee shredder with a hope of success Or will it hide them and let them operate

Posted by: Duffy at November 21, 2005 10:21 AM

I've followed the directions for updating the registry to fix the DSO Exploit problem, and yet the Exploit continues to return. It hasn't worked for me. Exploit continues to cause IE to attempt to connect at start-up. Any other suggestions?

Posted by: matt at November 22, 2005 03:14 AM

1) Make a note of the location of the exploit shown in Spybot, something similar to:
HKEY_USERS\S-1-5-21-1614895754-73586283-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
2) Click on Start, Run, and type REGEDIT and Press Enter to open the Windows Registry Editor
3) Find the location of the exploit above in the registry by clicking on the pluses(+) next to each title
4) After opening the Zones section and clicking on '0' look to the right window, under 'name' is the key '1004' and the type is REG_SZ simply right click and delete this REG_SZ value.Then right click and create new>DWORD Value, name it 1004, then right click on that and goto modify, give it the Hex Value of 3, Click ok.
If there is only a DWORD Value for the key (in this case 1004), then double click on the key and change the HEX value to 3 and click Ok.
5) Close the Registry Editor and Reboot your computer
6) The DSO Exploit should now be removed and it should no longer appear in the Spybot Search and Destroy log as a problem.

Posted by: Harborsidefx at December 16, 2005 11:43 AM

I have found DSO Exploit does prevent certain Web pages from loading - eg Oracle Forms applications (doesn't affect Mozilla Firefox).

Going to try editing the registry - is this going to remove DSO exploit for good (Spybot removes it but it returns)

Posted by: Neil at April 23, 2007 07:47 AM

Post a comment on "What's a 'DSO exploit' and how do I get rid of it?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!

(you may use HTML tags for style)

New!

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

Please wait. Your comment is being processed ...


Ask Your Question:


ask-leo.com
Web

Stay Informed

Weekly Newsletter

Archives

By Category
By Date

Advertisers

Advertise on Ask Leo!

««   »»

Question? - Ask Leo!
Who is Leo?
Link to Leo!

Terms, Conditions & Privacy