| reply to gate1975mlm
Re: Spybot - Search & Destroy 1.3.1 TX Update!! Does this update address nothing but the DSO exploit bug? If so, I guess I can get by without it because I already "repaired" the registry by using this fix:
"Hi Bill,
Regarding your post on removing DSO Exploit, please review the following steps:
PROBLEM:
Spybot Search & Destroy identifies malware called "DSO Exploit" is infecting your registry but Spybot S&D is unable to remove or correct the problem. Because Spybot
S&D cannot resolve the problem it may report the symptom each time you scan. Spybot
S&D may identify a DSO exploit in any of the following five registry keys.
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004
HKEY_USERS\S-1-5-21-746137067-1677128483-854245398-1003\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\Zones\0\1004
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004
Note: The long number in the second key (after S-5-21-) varies from
machine to machine.
CAUSE:
Spybot S&D cannot correct the problem because the registry keys in question are
corrupt. The registry keys identified above are legitimate but the data type has
been changed by a 3rd party program from the original type: REG_DWORD to REG_SZ.
This type setting prevents Spybot S&D from resolving this issue.
RESOLUTION:
Change all of the [1004] keys from type Reg_SZ to type REG_DWORD and assign
each a value of 3.
Note: as a precaution you should back up each key prior to making the changes.
SPECIFIC STEPS:
1. Click Start, then Run.
2. Type REGEDIT in the Run box and either hit Enter or click OK.
3. Locate the following registry key:
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004
4. Right-click on the 1004 key and select Rename
5. Rename this key to -1004.
Note: this -1004 key will be the backup of the original key.
6. Click on the Edit menu, then New and select DWORD value.
7. Give the new Key a name of 1004.
8. Right-click the new 1004 key, select Modify, give it a value 3 and click OK.
9. Repeat steps 3-7 for each of the above registry keys.
Note: remember that the long number after S-1-5-21 above will differ on
each machine.
10. Close the registry editor.
11. Click Start, then Control Panel.
12. Click Network And Internet Options, then click Internet Options to open
up the Internet properties.
13. Click on the Security tab, then click the Internet icon, then click
Custom level.
14. Ensure that Download unsigned ActiveX controls is set to Disable.
15. Click [OK] on Security Settings and then click [OK] to close Internet
Properties.
16. Run Spybot S&D again, this time DSO Exploit should not show up.
=========
This posting is provided "AS IS" with no warranties, and confers no rights.
MBSA Homepage:
»www.microsoft.com/MBSA
Windows XP Security Homepage:
»www.microsoft.com/windowsxp/secu···ault.asp
Windows 2000 Security Homepage:
»www.microsoft.com/windows200..it···ault.asp
Top 10 Windows Newsgroups Security Questions:
»www.microsoft.com/technet/ne..te···/newsgro
ups/nodepages/sectop10.asp
=========
Paul Hayes, MCSE
Product Support Services
Microsoft Corporation"
Sorry, but I don't have the link to the site where I found the fix.
--
Many years later, as he faced the firing squad, General Aureliano Buendia was to remember that distant afternoon when his father took him to discover ice.--Gabriel Garcia Marquez-- One Hundred Years of Solitude |
