Larian Studios Forums General Chat Chat (Anything) DSO Exploit

Spyware <img src="/ubbthreads/images/graemlins/ouch.gif" alt="" />!

OK, if anyone happens to know how to remove it, I wouldn't mind if you shared the knowledge with me. My brother mentioned we've had it downstairs (and that it was annoying as hell, which I havn't noticed. Yet), and that you had to do loads of stuff in safe mode. I tried to remove it in safe mode (I allso noticed that it was 5 units in normal moed, but only four in safe mode. Hmmm <img src="/ubbthreads/images/graemlins/think.gif" alt="" />), which didn't work, so I've put it on ice until my brother wakes up so I can ask him if he rememberred how he got rid of it.

Übereil

http://www.pchell.com/support/dsoexploit.shtml

Tnx m8!

BTW: It's a bug in Internet Explorer (hmm, I use firefox <img src="/ubbthreads/images/graemlins/think.gif" alt="" />)!

It allso said that if I run the latest verision of Windows and IE (I still use FF) it shouldn't be a threat, so removeing it is purelly visual. It allso sais that changeing the wrong file might make Windows not booting. I ignore it...

Übereil

Microsoft antispyware , can't reccomend it enough, did the trick for me Ube, give it a wirl. <img src="/ubbthreads/images/graemlins/up.gif" alt="" /> <img src="/ubbthreads/images/graemlins/up.gif" alt="" /> <img src="/ubbthreads/images/graemlins/up.gif" alt="" />

I use the "Spybot Search & Destroy"

the best of the best and Spybot Search & Destroy doesn't hae corruption.



You were saying spick <img src="/ubbthreads/images/graemlins/biggrin.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" />

I use Spybot AND spywareblaster for the best protection <img src="/ubbthreads/images/graemlins/up.gif" alt="" />. Then again, I still managed to get spyware...

Übereil

Hmmm ... stop going to those naughty sites Ube <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" />

Wel S&D is a scanner. Shure ithas some features to prevent spyware but it is just a scanner. Only you can prevent spyware.

or forest fires

morbo's right, Ube. it all comes back to u & how safe do u surf the net. just like driving a car with all the bells & whistles of safety but if u're reckless, those things can't save u.

Well morbo all i can say is i was running Spybot but when i installed Microsofts version it picked up several new spyware incuding the one that was realy getting on my t1ts, the one that highlighted text in all web pages to direct you to a new website.....It's good enough for me, but you do need to be operating a "Genuine Windows Application". <img src="/ubbthreads/images/graemlins/shhh.gif" alt="" />

Mea, stop spying on my private life!

Übereil

Every anti-spyware program specialises in different spyware categories....

I know for a fact that Spybot removes the DSO exploit (if you UPDATE it, without the updates it finds it, but doesnt remove it completely).

The only way you will stop spyware completely is if you get off the internet COMPLETELY.... every day there is an average of 5000 new spyware variants (in all categories, from cookie trackers to xxx dialers etc) that gets released. I know a lot of these are still the same ones.... but all you really need to do to change the spyware, is change the "signature" or thumb print that the anti-spyware programs search for, and they cant find or remove it anymore.... and have to get updated to find it again....

They did a survey with IT Lan administration personnell.... 85 % of them rated Spyware more dangerous than viruses!!!!!! (now in dangerous i am not referring to the risk of data loss or even data security.... (that is important, but not the main focus of the study) i am refering to irritation caused to the end-user, difficulty in removing, damage to network integrity (a lot of spyware causes network errors etc), computer stability and 3rd party software errors caused by altered DLL files, and spyware-background processes running.

throw in anything technical in the forum, & we'll be sure to see our south african princess (or is it queen?) flying in to the rescue. <img src="/ubbthreads/images/graemlins/cool.gif" alt="" />
<img src="/ubbthreads/images/graemlins/offtopic.gif" alt="" /> how are u, Lady Rain? how's hubby, the doggies & the surround-the-house sound system? <img src="/ubbthreads/images/graemlins/biggrin.gif" alt="" />

Spybot is fully updated, and it can't remove it. But as I mentioned, it doesn't seem to matter uless I start useing IE again...

Übereil

lOL @ Jaggnut

I am fine.... very very over worked.... but i am looking for a job now where i can do all the no-brainer jobs that no-one wants to do.... just for a while.... so i can recover... then i will go back onto the difficult stuff....

also in the process of buying a house... so running around trying to sort that out... etc etc etc etc etc

Doggies are fine... they busy wrestling me for my sarmies <img src="/ubbthreads/images/graemlins/winkwink.gif" alt="" /> Hubby is fine... stressed, but fine.... and the surround sound system is playing in the background.... i think... not paying attention to any noise lately.... "my koppie raas so hard, ek kan nie enige iets anders hoor nie" (Gal will love that one)..

The direct translation of that loses all the meaning... but it comes down to my head is making so much noise (refering to being crazy in the language of origin) that i cant hear anything else. <img src="/ubbthreads/images/graemlins/winkwink.gif" alt="" />

-------------------------------------------------

ok, onto resque mode <img src="/ubbthreads/images/graemlins/winkwink.gif" alt="" />

if you search for the problems and it brings up the DSO's... right click on one of them (not the group), and select "more details" -> "Jump to location" (the first time you need to do it twice before it jumps to the location in your registry - i dont know why), then wait for it to jump to "1004" (dont ask i just know.... ) and delete the value. (make sure you only delete "1004" values... not any other numbers.

Do this for the first 4 of the 5 entries it finds in spybot.

ignore the last one. it will go away by itself without the first 4 to resurrect it.

There you go.. no more DSO's EVER... that removes the ability of DSO's to resurrect themselves.... (IE repairs itself on boot-up.... one of those irritating features that makes IE viruses and JAVA virus a mission to get rid of)

En zo dit Mea <img src="/ubbthreads/images/graemlins/ROFL.gif" alt="" /> <img src="/ubbthreads/images/graemlins/ROFL.gif" alt="" /> <img src="/ubbthreads/images/graemlins/ROFL.gif" alt="" /> <img src="/ubbthreads/images/graemlins/ROFL.gif" alt="" />

<img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" />

<img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" /> <img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" /> <img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" /> <img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" /> <img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" /> <img src="/ubbthreads/images/graemlins/bday_jump.gif" alt="" />

What can i say <img src="/ubbthreads/images/graemlins/silly.gif" alt="" />

I only found one 1004 value <img src="/ubbthreads/images/graemlins/suspicion.gif" alt="" /> (in the first file). After deleteing it could only fix three of the five problems. I'll reboot now and see if they disappear.

Übereil

Edit: Exiting. I'm scanning with spybot after rebooting twice (the second time some kind of program had to close to protect the system. The system was spamming that message...) Still DSO <img src="/ubbthreads/images/graemlins/disagree.gif" alt="" />. Now only three files though. And no 1004 numbers...

Sneaky [email]bast@rd.[/email] When going to it opened the same map, there were five maps (named from 0 to 4), it opened map 0 no matter what file. I checked the other maps and there were 1004 files there too! I removed all of them. DSO is no history <img src="/ubbthreads/images/graemlins/devil.gif" alt="" />!

Ok... my bad <img src="/ubbthreads/images/graemlins/winkwink.gif" alt="" /> thats what i was trying to tell you, is check the first 4 maps.... but my brain is roasted.... (did i mention overworked????) so my communication skills are down to the bare minimum..... as in... I NEED COFFEE, or F*** OFF I AM TRYING TO VEGITATE

<img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" /> <img src="/ubbthreads/images/graemlins/evilgrin1.gif" alt="" />

Glad you got it sorted <img src="/ubbthreads/images/graemlins/smile.gif" alt="" />

The worlds Most Malicious Software = MICROSOFT