How do I remove the DSO Exploit that SpyBot Search and Destroy detects?

Have you removed the trojan with Spybot's removal option? if so is it returning on re-boot? if so you will have to make changes to your registry. Once Spybot has finished scanning on the DSO found click the + to see the path to where the changes have been made by the trojan. If you post the path here that will give a better idea as to what it is. M

If you have used Spybot to remove the DSO exploit, it is gone. The entrys that appear when you subsequently run Spybot are a bug in Spybot; it does not change the register name somehow so as not to show. The register entrys are dead as well as the infection itself. Everyone who uses Spybot to kill DSO has the same problem. I am sure it will be corrected in the next upgrade release of Spybot.

Further Reference at Computer Cops: http://computercops.biz/postlite46126-dso.html Dial down to Calamity Jane's post for a full explanation

The easiest way is to get the little DSOSTOP download. Simply run it once and the registry entries will be edited for you rather than digging for them yourself. http://www.nsclean.com/dsostop.html _________________________ The internet is no longer a toy, it's a COMBAT ZONE!

Spybot initially detected and removed FIVE DSO Exploits. However, they reloaded themselves at each reboot. Then I ran "dsostop2" -- which removed ONE of the five DSO Exploits. The other four are still there, however, apparently unaffected by dsostop2. What do I do now? Here are intruders still identified by Spybot, and which I can't remove permanently so far: DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-8\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-0\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-9\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) KEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

I've had and still have the same problem. My main concern however, is what this DSO exploit actually does. Since a live update of Norton Internet Security on NIS2002, I am unable to access some password protected websites (the userID/password dialog simply doesn't come up) and this DSO problem started at excatly the same time. Coincidence?