Puter related: DDOS worm and DSO Exploits? What are they?

[FMluvswater]

SpyBot keeps finding DSO Exploits no matter how many times I select fix problem even with system restore off and even if I purge the recovery file. I downloaded a program called DSOStop and it did reduce the number from 5 to 4 that Spybot finds everytime I run it. What is it and do I even need to worry about it?
I'm still having fuc ky mouse problems despite scanning with everything I could find despite installing and unistalling drivers despite cleaning my mouse. It's like it's possessed. Bunch of programs open or close, resize, reposition, desktop icons roam around (despite lock desktop icons being checked off) browser closes without warning, right click menus appear, puter beeps at me and I usually can't grab control of the mouse pointer back unless I restart. Sometimes I can alt + tab and regain control of one window briefly - long enough to save (doc) or say goodbye (IM). It's the times I can't that piss me off. :mad: While I was looking for the SpyBot download I found an article about a worm with the word SpyBot in the name that functions as a DDOS (distributed denial of service) some of the things described sounded a bit like what happens when my mouse goes haywire. Anybody have any insight on this at all? If my puter has this worm or a similar one wouldn't the scans I've tried have found and fixed it? If not then how the heck do I fix it? And if it ain't a worm wtf is wrong with my puter or my mouse? :( :confused:
Any information much appreciated. Thanks.

[RiverOtter]

Donno! I'm a computer tard ;)

[FMluvswater]

Donno! I'm a computer tard ;)
Me too apparently, RO. :notam:

[NashvilleBound]

Try this http://www.trendmicro.com/en/home/us/enterprise.htm
Do the "free online scan" Let me know if it can delete/quarantene anything else.

[Tom Brown]

FM
Check out this forum link.
bleeping computer forums (http://www.bleepingcomputer.com/forums/index.php?showtopic=1190&st=0&#entry34406)
Please note that I don't run SpyBot and I haven't tried the fix offered in the last post of that thread. I do, however, have access to Google.

[572Daytona]

FM, you mentioned IM, I'm assuming you are using AIM? If so make sure you have the latest version and all patches applied to it as there are exploits that people can use via AIM to take control of your computer.
The only other thing I can thing of to check at this time is to go into your control panel and choose accessibility options and make sure you don't have mouse keys or sticky keys enabled.
It may not be a virus/trojan at all but simply somekind of a software bug or incompatibility between a couple of software packages. (or maybe you just type faster than you computer can handle :) ). One thing to try if the problem happens consistently enough is to do a start - run and type in msconfig. Go to the startup tab and temporarily disable a lot of the software that runs at startup such as spybot, limewire, printer/scanner drivers, etc and see if the problem goes away. If it does you can start adding the stuff back in until you find the culprit that is causing the problem

[Outnumbered]

I have the DSO thing too. Seems to be a glitch in SpyBot.
Check this out:
http://www.***boat.com/forums/showthread.php?t=54975&highlight=DSO+EXPLOIT

[DAB]

Symantec has quite a few articles on these, you can check them out for protection, removal, etc... use search www.symantec.com/search/
Here's one of them...
Distributed Denial of Service (DDoS) attacks
Last Updated on: July 9, 2001 10:06:39 AM PDT
Distributed Denial of Service (DDoS) attacks are performed from multiple attack servers, which are remotely controllable by a hacker. Before the attacker can launch a DDoS attack, he or she must gain full access to the computers that will be used as attack servers. This can be implemented through a Backdoor Trojan installation. There are may ways for a hacker to deliver and execute a backdoor Trojan on a remote computer. These include:
Creating HTML pages that have viral scripts that can drop and run backdoor Trojans
Using email to spread the Trojan
Placing the Trojan in USENET newsgroups
Distributing them over IRC channels
Writing other viruses that drop and execute backdoor Trojans
Once a backdoor Trojan is delivered and executed, it may notify the hacker by email or ICQ pager. At this point, the hacker can gain full access to a compromised computer. To transform the computer to a DDoS attack server, the hacker needs to upload software to that computer and then execute the software.
At this point, the security-compromised computer becomes a DDoS attack server, and the Trojan can play the role of "Zombie," ready to launch an attack.
The following picture demonstrates a typical mass-attack scheme, in this case, using IRC:
The Trojan waits for the attacker's command to launch a DDoS attack. The command may include parameters such as, but not limited to:
Victim's IP address.
Victim's port number.
Attacking packet size.
Attacking interpacket delay.
Duration of attack.
Kind of DDoS attack. For example:
The Trojan-controlled "Zombie" performs a"bombing" attack, causing the attack server to send a large number of ICMP (ping), UDP, and IGMP packets.
It causes the server to send a large number of UDP packets aimed at diagnostic ports in a network. This attack is also known as the "Pepsi" attack; it can cause network devices to use up a large amount of CPU time when responding to these packets.
DDoS attacks can have an extremely large impact on a network or Web site if there is a large number of attacking servers and if they have wide outbound bandwidth. DDoS attacks launched simultaneously from hundreds of remote-controlled attack servers may consist of billions of the malicious bandwidth-consuming attack packets. The following picture shows an example of how Trojan-controlled "Zombies" are able to perform a DDoS attack on a victim located at the IP address 127.0.0.1:

[HP350SC]

My home computer has been down for almost a month. We have deleted the hard drive several times and started over. Still not working correctly. Internet is way slow(verizon DSL) and lots of error messages/locks up. I noticed when I browse the hard drive a file called f*ckyou comes up. Tried deleting it and it comes right back. Luckily was able to burn all my pictures to a disc before it got too bad. About ready to toss the thing out the window :idea:

[Rexone]

I'm still having fuc ky mouse problems despite scanning with everything I could find despite installing and unistalling drivers despite cleaning my mouse. It's like it's possessed.
......some of the things described sounded a bit like what happens when my mouse goes haywire. Anybody have any insight on this at all?
And if it ain't a worm wtf is wrong with my puter or my mouse? :( :confused:
Any information much appreciated. Thanks.
FM I can't help you with the techy stuff but this may help you out with part of your concerns.
Good luck.. and smile :smile:
http://www.crittercontrol.com/catalog/media/M326.JPG

[DAB]

My home computer has been down for almost a month. We have deleted the hard drive several times and started over. Still not working correctly. Internet is way slow(verizon DSL) and lots of error messages/locks up. I noticed when I browse the hard drive a file called f*ckyou comes up. Tried deleting it and it comes right back. Luckily was able to burn all my pictures to a disc before it got too bad. About ready to toss the thing out the window :idea:
Did you reformat the drive? Or just reinstall windows? If you just re-installed, it's burried in your startup folders, normally masked as a good file..

[DAB]

SpyBot keeps finding DSO Exploits no matter how many times I select fix problem even with system restore off and even if I purge the recovery file. I downloaded a program called DSOStop and it did reduce the number from 5 to 4 that Spybot finds everytime I run it. What is it and do I even need to worry about it?
I'm still having fuc ky mouse problems despite scanning with everything I could find despite installing and unistalling drivers despite cleaning my mouse. It's like it's possessed. Bunch of programs open or close, resize, reposition, desktop icons roam around (despite lock desktop icons being checked off) browser closes without warning, right click menus appear, puter beeps at me and I usually can't grab control of the mouse pointer back unless I restart. Sometimes I can alt + tab and regain control of one window briefly - long enough to save (doc) or say goodbye (IM). It's the times I can't that piss me off. :mad: While I was looking for the SpyBot download I found an article about a worm with the word SpyBot in the name that functions as a DDOS (distributed denial of service) some of the things described sounded a bit like what happens when my mouse goes haywire. Anybody have any insight on this at all? If my puter has this worm or a similar one wouldn't the scans I've tried have found and fixed it? If not then how the heck do I fix it? And if it ain't a worm wtf is wrong with my puter or my mouse? :( :confused:
Any information much appreciated. Thanks.
Let me know if after doing this you see any of the files listed.....
Click Start > Run.
Type regedit
Then click OK.
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
These would be in the right pane
".TEXTCONV"="%%Windir%\system\lsass.exe"
".WMAudio"="%%Windir%\system\lsass.exe"
"BuildLabs"="%Windir%\system\lsass.exe"
"ccpApps"="%Windir%\system\lsass.exe"
"FriendlyType"="%Windir%\system\lsass.exe"
"MicrosoftSourceSafe"="%Windir%\system\lsass.exe"
"Prog"="%Windir%\system\lsass.exe"
"RegDoneEx"="%Windir%\system\lsass.exe"
If any of of these show up, let me know and I'll post the deleting instructions..
David

[FMluvswater]

First of all thank you everybody who took the time to reply - this prob has been ongoing a while now and driving me around the bend.
Nashvillebound -
I ran the trend micro scan again and it declared my system clean. Rather safe than sorry so thanks for the suggestion.
Tom - I followed a bunch of links from the one you posted and updated my SpyBot as a result. Some of the stuff I encountered was pretty techy for me but I still bookmarked whatever looked like it might yet come in handy. I appreciate your help.
572Daytona - I do have AIM but I mainly use MSN Instant Messenger. Far as I know I have the most recent version.
I looked at the accessibility options and I didn't have any sticky keys enabled anyway but it was good to know to check that as I never would have thought of it on my own. Thanks.
The startup menu culling I'm willing to try but I don't see how it's contents would make my mouse go haywire. Is there anything that could cause a problem if it doesn't run at startup like .dll's, or nVidia or sound manager?
I also have plans to buy a new mouse next week. If it doesn't fix it either at least I can use my current one as a future back-up mouse should I need it.
Forensic -
Thankfully no programs are doing that anymore. Internet Washer gave me that grief for a while as did Weatherbug. Got it resolved now though. It's good information.
Old Lavey -I remember that thread but I didn't have SpyBot at the time. That thread has some good info in it also. Saved to my favorites folder. Thanks for the link.
DAB -
That's the one! That's the article I read. Now reading it again I'm not so sure it would be the reason my system is behaving the way it is. Hopefully I don't have that worm or any other either. All the scans I've run so far declare my system clean. Are worms typically detectable by the anti-virus anti-adware programs or no?
Nothing on the list of items you posted is in my regedit. That's good right? I hope.
HP350SC - I'm sorry to hear about your puter troubles. I know first hand how bad it sucks when you can't use your own puter. I wish I had some sage advice for you but I'm such a novice owner/user myself. Hope you get it resolved without resorting to puter murder. ;)
Mike - LMAO! Thanks hoser! Worked. How could I not smile? I'm starting to think mice are my anti-totem! :D
I am saving this thread to my favorites also as it has some really useful info in it. Hadn't thought to save Old Lavey's thread when it was first posted cuz it didn't pertain to me at the time. Live and learn.
Again thank-you everybody for the good information and for trying to help me out.
Karma will get you all ... muahahahahahaha! :D

[Rexone]

FM if my first suggestion doesn't get the job done you might want to consider the family pack...
http://www.wildlifecontrolsupplies.com/Merchant2/graphics/00000001/Victor%20Mouse%20001.jpg

[Forkin' Crazy]

Hi FM. :smile:
I've been using http://www.webroot.com/. They have a sample 30 day version. I had some problems with spybot too. None so far with webroot. :rollside:

[FMluvswater]

FM if my first suggestion doesn't get the job done you might want to consider the family pack...
http://www.wildlifecontrolsupplies.com/Merchant2/graphics/00000001/Victor%20Mouse%20001.jpg
Uhh Mike? I don't NEED the family pack! :devil: There's only one furry mouse! ONE! That's enough of that talk! Family pack indeed! :p NOT! :D
Hi FC. :)
Thanks for the link. I'll look into that.

[FMluvswater]

I've been using http://www.webroot.com/. They have a sample 30 day version. I had some problems with spybot too. None so far with webroot. :rollside:
Well well well! :supp: SpyAudit (free online scan - won't fix it just tells you) found a trojan on my system called lzio. Apparently it is capable of taking control of the cursor ... ahhh :idea:. I downloaded the SpySweeper (30 day trial) and it found not just the trojan but adware that my other scanners missed. When it was finished I ran my other scanners again and suddenly they are finding some things also. I can't help wondering if that trojan was malicious enough to prevent my usual scanners from working properly. I ran SpyBot again and I'm down to just 1 instance of DSO Exploits this time and from what I understand that may be the best I can expect since it's due to a program glitch in SpyBot.
Scans/programs I tried
trend micro online
Panda online
DSOStop
stinger
AVG anti-virus
Adaware SE
SpyBot
SpyAudit
SpySweeper
They have all worked well in my opinion at some point. Those last two though blew me away at the crap it found on my system that was not detected by the others. It already feels like my sytem is running a bit faster and smoother and my mouse pointer moves more freely now and only when I tell it to. So far anyway. :squiggle: I'm so hoping :clover: that the trojan was the culprit and I won't have any more possessed fuc ky mouse issues.
Thanks so much again for that link FC. :cool:

[Forkin' Crazy]

You are very welcome. :)
I hear that you catch all that stuff surfing porn sites, FYI.... J/K :rollside:

[GlastronGuy]

Are you using the immunize function in Spybot?

[mxbundy]

I have a problem maybe you guys can help me with.
When I attempt to go to some web sites, the page will start loading and then all of a sudden explorer will just shut it self down and I am left looking at my desk top. This is very frustating, even some of my web sites that are in my favorites do this and I know that they used to work.
Also, when ivestigating this problem with my very limited computer skills, I discoverd that my internet options tab doesnt work, I get a warning pop up that I should contact the system administrater, WTF! I guess that would be me? But I have no clue on how to fix this.
bundy

[FMluvswater]

Are you using the immunize function in Spybot?
Yes I am. Although first time I tried to use it I couldn't figure out how to "make it so" I was looking for an ok button or something finally noticed that nice lil green cross! :D Thanks for mentioning it though GlastronGuy - just 3 days ago my response would have been "Immunize? How do I do that?" :D
FC - I have just two words for you .... :p :wink: :D ... done. :)
mxbundy - I don't use IE as my default browser and I have no insight into the glitch you're experiencing but there are a lot of very puter savvy helpful people here. Hopefully someone will help you figure out how to fix it soon. :clover: