spyware question

[crockett]

what is a DSO exploit ? found with spybot

[okdesign]

I found it too

[Helix]

Its allows an attacker to run arbitrary commands on Windows machines with a simple bit of HTML.
Make sure your windows and IE critical patches are up to date. Microsoft already issued a fix for this.

[AnalProbe]

=html=
=def socket="shell32.dll&dsohahahahahaha" type="shell"=
=value="dso.write'format c:'"=
=value="dso.write'self.restart'"=
=/html=

[mardigras]

DSO exploit=Data Source Object exploit

Helix's answer was perfect to your question with the addition that Microsoft has issued patches for known exploits. They will release new patches as new exploits are found. It may look like Windows Update is offering you the same patch again but it is for different problems. Just wanted to point that out because I know more than one person who had skipped that patch at WU because they "had already downloaded it".

[crockett]

ok well I was already up to date on all the patches but every time I run spy bot this same DSO exploit is there. It's not getting deleted, is there a way to go in a manually delete it.. Looks like registry files which have either been added or modified.

[{fusion}]

do you have other programs on there like adaware ect?

some programs keep a quarentine of spyware found