Spyware problem XP Home

[Len Cuff]

After a rebuild of my PC, I now seem to have got hold of some odd
Spyware program. If I run Spybot, it finds 5 entries under the title
DSO Exploit. I fix them and it says they have been fixed but they then
reappear again! I'm also getting IE windows popping up at random
saying that my PC is infected with Spyware!

Any ideas as to what to look for? I am running AVG 7 Pro and Zone
Alarm and neither indicate any problems.

I also get odd icons appearing on the desktop which can't be moved and
the properties shown.Things like Bingo, Online Casino etc.

TIA


cheers,
Len

 

[Guest]

I get the same problem, there are icons on my desktop which can't be deleted
(Online Casino etc etc). They dissapear when I go Ctrl+Alt+Del and stop the
IEXPLORE.EXE Process. I use Mozilla Firefox, and this Icon problem started
when my sister accidentally used Internet Explorer (Big Mistake). I would
like to know how I can erradicate IE from my computer as Bill Gates seems to
have burned it into the framework of Windows so we can't escape the virus
infested program that is IE.

When I run Ad-Aware, it doesn't find any Spyware and the icons are still
there.

I would E-Mail Microsoft but it costs £35 + VAT to send them 1 email, it
seems they haven't got enough money.

Thanks

Tibor

 

[Mike Hall]

Len

The DSO exploit reported by Spybot is a false report.. set Spybot to
'advanced' and use the settings to ignore the warning..

 

[wayne]

run your programs in SAFE mode. Hold down the F8 key when you boot. Try
running adaware also make sure you update the definitions too before you run
a scan. Same for Antivirus software.

Wayne

 

[Mike Hall]

Tibor

Many people run IE without any problems at all.. the problem isn't that your
sister ran IE so much as she downloaded and ran spyware/scumware.. what you
should do is ask your sister what she downloaded/ran..

 

[Bruce Chambers]

After a rebuild of my PC, I now seem to have got hold of some odd
Spyware program. If I run Spybot, it finds 5 entries under the title
DSO Exploit. I fix them and it says they have been fixed but they then
reappear again! I'm also getting IE windows popping up at random
saying that my PC is infected with Spyware!

Any ideas as to what to look for? I am running AVG 7 Pro and Zone
Alarm and neither indicate any problems.

I also get odd icons appearing on the desktop which can't be moved and
the properties shown.Things like Bingo, Online Casino etc.

TIA


cheers,
Len

The DSO exploit was patched long ago by IE Cumulative Update
MS02-015, in March of 2002. If you've installed this specific patch,
or any subsequent IE Cumulative Updates, IE Service Pack 1, or WinXP
SP2, you're safe. It would appear that the latest version of SpyBot
S&D is only checking for Internet zone settings in the registry that
could be used as work-around protection, and not for the presence of
any corrective patches. Hopefully, the makers of SpyBot will soon fix
this bug.

MS02-015 March 28, 2002 Cumulative Patch for Internet Explorer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;319182

If you like, you can test your system for this particular
vulnerability at this web site:
http://www.grey.com/security/advisories/gm001-ie/

The makers of SpyBot S&D have acknowledged the problem and will
fix it on their next update:
http://www.safer-networking.org/index.php?page=paragraphs&detail=currentfaqs

In the meantime, in SpyBot S&D, click Mode > Advanced > Settings >
Ignore Products > Security > DSO Exploit, to turn off the false alarm.

Some people have reported that the SpyBot Detection rules dated 30
Aug 04, or newer, when used with SpyBot S&D 1.3.1TX, will fix this
problem. However, I've had inconsistent results with that particular
detection update; sometimes it reads clean, then later it will once
again find the DSO problem, and then it will read clean again, all on
the same machine, with no other changes made.


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

 

[Bruce Chambers]

I get the same problem, there are icons on my desktop which can't be deleted
(Online Casino etc etc).

No, that's not even close to being the same problem. It's completely
unrelated to Spybot S&D's false alarm.

They dissapear when I go Ctrl+Alt+Del and stop the
IEXPLORE.EXE Process.

Then why not simply stop the rogue, hijacked version of IE from
starting when you start the computer?

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;310560

I would like to know how I can erradicate IE from my computer

Why? Do you prefer to chop off each toe as you stub it, or would you
rather learn how to watch where you're walking?

When I run Ad-Aware, it doesn't find any Spyware and the icons are still
there.

This is because you don't have the type of adware/spyware problem that
these utilities are designed to address. You have a hijacked browser -
something quite different. Your problem came about because you've not
been practicing Safe Hex. It could have been prevented. Learn how to
safeguard your computer.

SpywareInfo :· Prevent Browser Hijacking
http://www.spywareinfo.com/articles/hijacked/prevent.php

There are several essential components to computer security: a
knowledgeable and pro-active user, a properly configured firewall,
reliable and up-to-date antivirus software, and the prompt repair (via
patches, hotfixes, or service packs) of any known vulnerabilities.

The weakest link in this "equation" is, all too often, the
computer user. No software manufacturer can -- nor should they be
expected to -- protect the computer user from him/herself. All too many
people have bought into the various PC/software manufacturers marketing
claims of easy computing. They believe that their computer should be no
harder to use than a toaster oven; they have neither the inclination or
desire to learn how to safely use their computer. All too few people
keep their antivirus software current, install patches in a timely
manner, or stop to really think about that cutesy link they're about to
click.

Firewalls and anti-virus applications, which should always be
used and should always be running, are important components of "safe
hex," but they cannot, and should not be expected to, protect the
computer user from him/herself. Ultimately, it is incumbent upon each
and every computer user to learn how to secure his/her own computer.

To learn more about practicing "safe hex," start with these links:

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

Home Computer Security
http://www.cert.org/homeusers/HomeComputerSecurity/

List of Antivirus Software Vendors
http://support.microsoft.com/default.aspx?scid=kb;en-us;49500

Home PC Firewall Guide
http://www.firewallguide.com/

Scumware.com
http://www.scumware.com/

The Parasite Fight
http://www.aumha.org/a/parasite.htm



--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH