DSO Exploit blocked

[MP3it]

The first time I connect to internet I get a message that Avast has blocked access to to dso exploit.

This only started since Avast did last program update 2 days ago.  I have been trying to resolve an issue where my pc take 2 minutes to display a page after connecting, svchost > network services takes 100% cpu usage and wonder if this is related.

Avast home pre 4.5.  No spyware and virus scan runs clean.  Also ran scan on Trend website, just in case.  

Windows xp sp2.  Any ideas?  

Thanks, Alan

[Gillie2tat]

Can you take a note of the exact message you get including any IP numbers please and post it here?  It may be that you need to add a port to your firewall's blocking list as I did.

Sounds like the Network Shield spotting something that your firewall isn't which is what happened to me.

[MP3it]

I have tried to reproduce problem but only seems to happen when I boot pc and connect for first time after pc has been off for a while.

Message appears above sys tray in yellow box with red line on top and only stays for 2 seconds.  I beleive it says "Avast! has blocked access to dso exploit".

There is nothing showing in any of the logs and my firewall gets so badly hammered that it is impossible to get an ip.

Have run Adaware se and Spybot.  Spybot detect dso exploit, have cleaned but keeps coming back.  Checked Spybot forum, this is a known problem and no fix yet until next release.  Adaware runs clean and so does reg mechanic spyware sweep.

Don't know what else to tell you.

Thanks, Alan

[Gillie2tat]

Yep the only fix for that one is to tell Spybot to ignore it when you scan.  It's a known bug.

I'm at work at the moment and don't have the fix to hand, I'll look it up tonight when I get home or during my lunch break if I get a chance.

Don't know what to tell you about Avast in relation to this because my Avast has never noticed this one.  Maybe Technical or Vlk or one of the other experts can advise you.

[Eddy]

Click on the link in my signature and make sure your system is clean and up-to-date. Also use a firewall.

[MP3it]

I installed Hijackthis and deleted the Norton entries.  Spybot is in there, not sure why.  The only other questionable entry is the last one.

Problem is not happening today, Avast did program update again yesterday.  Will have to wait and see if I get message again but browser still takes forever to display page after connect.  

Using Sygate personal pro firewall, excellent.  Curious, Hijackthis installed but not listed on start menu but is in installed programs.    Posted results here for you.  

[Gillie2tat]

Sorry to be so long, I've found the info about the DSO exploit and Spybot.  It's to do with Spybot, not Avast.

If this is what you're getting


DSO Exploit: Data source object exploit (Registry change, nothing done)
       HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
       HKEY_USERS\S-1-5-21-117609710-764733703-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
       HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
       HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
       HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

You need to read this page for the fix - http://www.askmehelpdesk.com/cgi-bin/yabb/YaBB.cgi?board=computers_for_beginners;action=display;num=1082096807