Registry Modification affects DNS Services - How to correct?

[Guest]

A spyware removal tool, Spybot Search and Destroy" was repeatedly
unsuccessful in permanently removing a threat called "DSO Exploit".

After investigating the postings on www.askmehelpdesk.com about the subject,
I changed the registry values at the detected locations and found that my
browsers were no longer able to obtain DNS services. (I did permanently
clear the threat)

Working with QWEST MSN tech support. I was able to workaround the problem
by setting my TCP/IP settings on my wireless connection to my DSL from "get
DNS automatically, to Static IP addresses for the DNS servers.

Unfortunatley, I had made a mistake while deleting and reassigning some of
register the entries when I was "fixing" the DSO threat. I deleted the 1004
entries in 5 folders and reinstalled them as 1004 REG_ DWORD Hex 3 at the
following location:
"HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internert
Settings\Zones\" in folders 0,1,2,3,&4 .

I believe this is what caused the browsers to malfunction. Does anybody
know what the correct settings should be, or where I could go to discover
them my self?

Gary Greeno

 

[Ricky]

On my PC the values are..
Folder 0: 0
Folder 1: 3
Folder 2: 1
Folder 3: 3
Folder 4: 3
Hope this helps.

|A spyware removal tool, Spybot Search and Destroy" was repeatedly
| unsuccessful in permanently removing a threat called "DSO Exploit".
|
| After investigating the postings on www.askmehelpdesk.com about the
subject,
| I changed the registry values at the detected locations and found that my
| browsers were no longer able to obtain DNS services. (I did permanently
| clear the threat)
|
| Working with QWEST MSN tech support. I was able to workaround the problem
| by setting my TCP/IP settings on my wireless connection to my DSL from
"get
| DNS automatically, to Static IP addresses for the DNS servers.
|
| Unfortunatley, I had made a mistake while deleting and reassigning some of
| register the entries when I was "fixing" the DSO threat. I deleted the
1004
| entries in 5 folders and reinstalled them as 1004 REG_ DWORD Hex 3 at
the
| following location:
| "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internert
| Settings\Zones\" in folders 0,1,2,3,&4 .
|
| I believe this is what caused the browsers to malfunction. Does anybody
| know what the correct settings should be, or where I could go to discover
| them my self?
|
| Gary Greeno
|

 

[Guest]

Ricky,

I changed them all back to the values you indicated with the exception of
the value in folder 0 which I kept at Hex 3, since this value change was
required to get rid of the DSO threat. It seems to work OK. I changed back
to Automatic Addressing of DNS and worked like a champ! Thank you!

 

[Ricky]

You're welcome..glad it helped. Also here's some info about the DSO
exploit..
http://www.safer-networking.org/en/faq/36.html

| Ricky,
|
| I changed them all back to the values you indicated with the exception of
| the value in folder 0 which I kept at Hex 3, since this value change was
| required to get rid of the DSO threat. It seems to work OK. I changed
back
| to Automatic Addressing of DNS and worked like a champ! Thank you!
|
| "Gary Greeno" wrote:
|
| > A spyware removal tool, Spybot Search and Destroy" was repeatedly
| > unsuccessful in permanently removing a threat called "DSO Exploit".
| >
| > After investigating the postings on www.askmehelpdesk.com about the
subject,
| > I changed the registry values at the detected locations and found that
my
| > browsers were no longer able to obtain DNS services. (I did permanently
| > clear the threat)
| >
| > Working with QWEST MSN tech support. I was able to workaround the
problem
| > by setting my TCP/IP settings on my wireless connection to my DSL from
"get
| > DNS automatically, to Static IP addresses for the DNS servers.
| >
| > Unfortunatley, I had made a mistake while deleting and reassigning some
of
| > register the entries when I was "fixing" the DSO threat. I deleted the
1004
| > entries in 5 folders and reinstalled them as 1004 REG_ DWORD Hex 3 at
the
| > following location:
| > "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internert
| > Settings\Zones\" in folders 0,1,2,3,&4 .
| >
| > I believe this is what caused the browsers to malfunction. Does anybody
| > know what the correct settings should be, or where I could go to
discover
| > them my self?
| >
| > Gary Greeno
| >