[skullz90]

Hi
Every time I run spybot I get this in it DSO Exploit I have spybot fix it but next time I reboot and run spybot there it is again What is it ? Is it bad ? if so how do I get it from coming back?
Here is my hijack log
Logfile of HijackThis v1.97.7
Scan saved at 10:21:13 AM, on 7/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atiptaxx.exe
D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
D:\PROGRA~1\Grisoft\AVG6\avgserv.exe
D:\PROGRA~1\WINZIP\wzqkpick.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG_CC] D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /startup
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM (HKLM)

Thank you for any help on this
skullz

[Advertisements]

Hi,

DSO Exploit

From SpyBot official forum:

The problem with the DSO Exploit is a little bug. We have already been able to locate and fix it, but unfortunately it was not included with the last update. It will hopefully be with the next one.
The DSO Exploit is a security gap in IE. Microsoft did already repair this, so if you have all Windows updates and patches installed, it is not dangerous for your system.

HJT log
Upgrade to HJT 1.98.0

Clean
Just fix this
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
Never use an "Error Reporting Tool", anywhere. A memory dump may transmit personal or confidential data.

[Pierre (aka Terdef)]

Hi,

DSO Exploit

From SpyBot official forum:

The problem with the DSO Exploit is a little bug. We have already been able to locate and fix it, but unfortunately it was not included with the last update. It will hopefully be with the next one.
The DSO Exploit is a security gap in IE. Microsoft did already repair this, so if you have all Windows updates and patches installed, it is not dangerous for your system.

HJT log
Upgrade to HJT 1.98.0

Clean
Just fix this
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
Never use an "Error Reporting Tool", anywhere. A memory dump may transmit personal or confidential data.

[ditto]

Its a bug in the current version of Spybot S&D well that keeps coming back.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)

reboot and lets see a new log

[Pierre (aka Terdef)]

Hi

Right Ditto,
"File missing".
An unloaded app.
You did not let me time to edit my post.

Edited by Pierre (aka Terdef), 26 July 2004 - 09:21 AM.

[skullz90]

Hi
I removed things I was told to remove Thanks
new log
Logfile of HijackThis v1.97.7
Scan saved at 12:21:16 PM, on 7/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atiptaxx.exe
D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
D:\PROGRA~1\Grisoft\AVG6\avgserv.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVG_CC] D:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /startup
O9 - Extra button: AIM (HKLM)

thanks
skullz