I have a file "C:\WINNT\SYSTEM32\dolsp.dll", it's from "Deals Online". It loads thousands of spyware sites in the hosts files and if you remove them it just rewrites a new one with a few sites in it. It cannot be deleted, it cannot be unregistered, it cannot be detected by any spyware scanner. Even in safe mode it cannot be dealt with. I've exhausted every idea. If anyone has gotten rid of it or may know a way to potentially get rid of it, please le me know. I'd really appreciate it. Thanks.
I assume you have attempt to change the file attributes and/or rename the file? If that doesn't work you should be able to remove the file when not in the windows environment. What happens when you attempt to delete this file?
Access Denied Yes, I've attempted to rename, overwrite, change attributes. Explain how I can remove the file while not in the Windows environment. I'm using NTFS.
Knoppix, or any linux version that can run off removable media will, I think allow access. Knoppix fits on a CDR. You boot to the CD and run Knoppix from there. It is a large program so figure on some time to download it. 699MB. This version can also be useful to recover files when windows can't access a drive.
NTFS is usually only allows read-only access from other OS's
I actually have a copy of Knoppix. I ran Capture NTFS but it wouldn't load NTFS.sys and NTOSKRNL.EXE.
"Knoppix-STD is a customized distribution of the Knoppix Live Linux CD. Boot to the CD and you have Knoppix-STD. That would include a customized linux kernel (2.4.21 with ntfs rw, openmosix, and superfreeswan patches), Fluxbox windows manager, incredible hardware detection and hundreds of applications. Boot without the CD and you return to your original operating system. Aside from borrowing power, peripherals and some RAM, Knoppix-STD doesn't touch the host computer".
Have you tried deleting or renaming while in the safe mode?
Suggestions: 1. Search for the file in the registry, and delete any entries containing a reference to it. You may well find it in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
2. Install Recovery Console, boot into it, and delete it from the command line.
You can't delete from the recovery console and I've tried editing the registry. I ended converting the partition to FAT32 and booted from a 98 boot disk. I deleted the files and removed the entries in the HOSTS file but on bootup it just recreated another DLL file. I booted from the boot disk again and ended up deleting all DLL's by mistake due to my use of the NT command-line. I did del "*msft3.dll" and it deleted all the DLL files instead. That was one of the many files ending with "msft3" that "magically" appeared. Anyway, needless to say, I had to reinstall 2000 again. I certainly wouldn't mind to know if there is a way to remove this spyare since it may very well happen again and I really don't feel like formatting or reinstalling Windows again.
try downloading http://www.cexx.org/lspfix.htm
click "I know what I'm doing" and move the "dolsp.dll" file to the box on the right, and click FINISH. Restart the computer. See if that does it.
Thanks alot. I'll download that. Really appreciated. :)
