Hej Carsten
Kan dette hjælpe?
On Mon, 31 Jan 2005 18:53:48 -0500, "Firewire"
<firewire@nowhere.invalid> wrote:
>Several months ago I discovered that Spybot S&D had a glitch which detects
>DSO Exploit when there is none. I uninstalled Spybot and used only Ad
>Aware
>until now. I downloaded a new version thinking Spybot S&D had fixed the
>false positive. Months ago their web site said they had repaired the
>problem and it would be corrected with an update. I updated the new
>download I installed today, version 1.3 but the DSO bug is still in Spybot,
>or is it? Do I have a problem with my Windows XP Home, SP2 applied, or is
>Spybot still not repaired?
Spybot S&D 1.3 is the latest public version. You have to apply the
1.3.1 TX "patch" (see below) to correct the DSO EXPLOIT bug still in 1.3
and 1.3.1 (beta).
You can deal with the false flags several ways - ignore them, set
Spybot S&D to ignore them, or correct them (either with the fixed Spybot
S&D version or manually):
-IGNORE THEM:
The DSO EXPLOITS are incorrectly "fixed" by Spybot S&D so they show up
again on the next scan. If you are up to date on your Microsoft updates
and patches then you don't have to worry about the DSO EXPLOITS, as that
particular "weakness" has been corrected.
-SET SPYBOT S&D TO IGNORE THEM:
To stop the DSO EXPLOITS false flags you can set Spybot S&D to ignore
them:
-Open Spybot S&D, click on SETTINGS.
-Click on IGNORE PRODUCTS
-Click on SECURITY
-Check the DSP EXPLOIT box
-CORRECT THEM (WITH FIXED SPYBOT S&D):
You can download and install "Spybot S&D 1.3.1 TX" which corrects the
DSO EXPLOIT problem in Spybot S&D. This will replace the executable
ONLY, so you must already have either "Spybot S&D 1.3" or "Spybot S&D
1.3.1" installed. You can download "Spybot S&D 1.3.1 TX" from:
<
http://www.majorgeeks.com/download4392.html>
-CORRECT THEM (BY MANUALLY EDITING THE REGISTRY):
You can fix them manually by running regedit and editing the specific
keys to a DWORD value of 3.
Go to each specific key Spybot flagged and right-click on the bad 1004
key (will show a REG_SZ instead of a REG_DWORD for data type) in the
right panel and select Delete.
Then in a blank section in that same right panel in regedit, do a
right-click and add a "New" > "DWORD" value.
Name the new DWORD value 1004 (like the one you just deleted).
When it is created, double-click on it and enter a value of 3.
If you have multiple versions of this under different users on your
system, you'll need do the same thing for each of them.
After manually repairing the keys run Spybot again to see if you missed
any keys. Don't let Spybot try to fix any of the keys, just use it to
find the specific problem locations.
-EXPLANATION:
Basically, Spybot is finding that the security setting for "Download
unsigned ActiveX controls" for the (normally) hidden "My Computer" zone
in Internet Explorer is not set to disabled, and a minor bug is
preventing Spybot from repairing it properly so it is again detected on
the next scan.
You are probably seeing several keys similar to this one:
DSO Exploit: Data source object exploit (Registry change, nothing
done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3
The "\0\" points to the My Computer Zone. The key "1004" holds the
value for the specific setting "Download unsigned ActiveX controls".
The "!=" means "not equal". "W=3" (word value of 3) specifically means
"disabled". Read "1004!=W=3" as "The key 1004 does not contain a word
value of 3." Meaning Spybot is finding that this setting is not
disabled for various users defined on the system and is flagging it.
When it attempts to fix that value (setting it to 3) it isn't setting
the proper type of data element - a DWORD value. So, that registry item
ends up with no value at all after the fix is performed, and each time
you scan again Spybot will find the value in those keys is still not
equal to 3.
--
dak
My SpywareBlaster Custom Blocking List:
<
http://customblockinglist.cjb.net/>
venligst lånt fra grc.spyware newsgroup.
vh
Sysmofytten