Member Avatar for PRAKHAR

Can Anyone Help Me In Fixing Dso Exploit Malware In Spybot???


It Repeatedly Comes Back Even After I Fix It.


Thanking In Advance!!

  • 5 Contributors
  • 5 Replies
  • 358 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by nosound

Dani AI

Generated

Short primer and practical steps — adds technical detail to the replies by , , , and .

Spybot’s “DSO Exploit” label is not a file name; it flags an Internet Explorer security setting (registry values under the Internet Settings\Zones keys). Those numeric values map to specific IE behaviors — for example 1004 is the “download unsigned ActiveX controls” setting and 1406 is “access data sources across domains.” Seeing the entry means a zone setting is non-default, not that a single executable has been dropped. (learn.microsoft.com)

A safe, diagnostic-first workflow (don’t edit until you back up):

  • Inspect the zone entries from an elevated command prompt and export them before changing anything. Example commands:
    reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v 1004
reg export "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" "%USERPROFILE%\Desktop\DSO-DEFAULT.reg"

    Run these for any HKU\S-1-5-... SIDs you see. Always make a System Restore point and export the key first. (reg.exe is the built-in tool shown here). (commandwindows.com)

Non-destructive fixes to try before manual deletion:

  • Use the Internet Options GUI to reset a zone to defaults, or use Microsoft’s security-template reset if the settings are deeply inconsistent (examples: secedit /configure /cfg %windir%\repair\secsetup.inf for older XP flows, or the defltbase.inf method on later systems). These approaches restore the registry policy entries rather than blunt‑deleting keys. Back up the system state first and read Microsoft’s guidance before running them. (support.microsoft.com)

When to escalate: if the registry values reappear after a clean reset, or you see unexpected autostart entries, inspect with Autoruns (Sysinternals) to find persistence points and then run up‑to‑date anti‑malware scanners (Malwarebytes, Microsoft Safety Scanner, etc.). Autoruns can show per‑user autostarts so you can confirm whether the DSO‑related entries are configuration artefacts or part of a persistent component. (learn.microsoft.com)

Notes and cautions: manual registry deletion can break other settings and is risky without a backup; prefer inspection -> export -> reset -> verify. The Spybot reports you’re seeing have a long history of being scanner/configuration issues rather than a single disk payload (Spybot staff discussed this behaviour on their forum). (forums.spybot.info)

Recommended Answers

All 5 Replies

Member Avatar for p3-450

If you have all the windows security updates and patches then you are safe from the dso exploit.

But there is a bug with Spybot that will still find the entry each scan.

What you can do is

1. Open Spybot and select 'advanced' mode.
2. Select 'settings' in the left column.
3. Select 'ignore product' in the left column.
4. Select 'security' tab.
5. Place check mark in box beside DSO Exploit.
6. Close program
7. Open Spybot and run a scan.

Member Avatar for PRAKHAR

this is not a true solution!!!

Member Avatar for deonnanicole

But if you have all of your Windows updates, it is just a bug within Spybot. It's not actually on your computer, so setting it to ignore it is fine to do. But again, this is ONLY if you have all of your windows updates.

Member Avatar for crunchie

It is a true solution if you have all your security patches installed!!
Go to Spybot S&D's forums and see for yourself :).

Member Avatar for nosound

i had the same problem but here is what i did. when you scan and find it hit the little minis sign and see if it is a regesty key. if it is right click it and go to save results. then go to the spot you opened it with notepad. then open regedit by going to start then run and type "regedit". then on notepad look for the registry key and find out where it is and delete it. but be careful, if you delete the wrong thing it will mess you up. but that is how you solve the problem because everytime you restart it loads back in. this stops that

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.