恶意软件之BHO篇
现在各种恶意软件很是流行，现将有关IE相关的恶意插件之BHO相关收集于下:
BHO就是Browser Helper Object(浏览器辅助对象)!
Also called BHO. A BHO is a small program that extends Microsoft's Internet Explorer. Examples of BHO usage include visible add-on toolbars in IE, but can also be hidden functions. Ad- and spyware as well as browser hijackers often use BHOs to display ads or follow your moves across the internet, because a BHO has access to each URL you visit and can redirect you or display other pages than you requested (ads, for example).
BHOs often use ActiveX installation programs.
Also called BHO. A BHO is a small program that extends Microsoft's Internet Explorer. Examples of BHO usage include visible add-on toolbars in IE, but can also be hidden functions. Ad- and spyware as well as browser hijackers often use BHOs to display ads or follow your moves across the internet, because a BHO has access to each URL you visit and can redirect you or display other pages than you requested (ads, for example).
BHOs often use ActiveX installation programs.
可能大家都在IE的工具栏上见到过QQ,迅雷,网际快车等类的工具,有些恶意软件也借助于此兴风作浪,只要打开IE就会被加载!不能用正常方法卸载掉,此文略掉深层理论部分,一因本人水平有限,二因网络上可以很容易搜索到相关信息!只将处理办法列出!
BHO关联原理:
1.IE的窗口打开时,先寻找HKLM下的SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 里的CLSID,这些CLSID,都对应着相应的BHO插件，然后根据这个CLSID到HKCR下的CLSIDs里找到此插件的信息，包括文件位置等。
2.IE根据找到的CLSID信息创建 BHO 对象,并且查找 IObjectWithSite 接口. (这个接口非常简单,只有SetSite和GetSite两个方法)
3.IE把IWebBrowser2(浏览器插件)传到 BHO 的 SetSite 方法，用户在此方法中可挂载自己的事件处理方法。
4.窗口关闭时,IE把 null 传到 BHO 的 SetSite 方法，此方法用来去掉挂载的事件处理方法。
解决方法:
打开注册表项到:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\可以看到下面有一些CLSID值,这些值对应相关的插件,点击可以在默认值后看到相关插件的名称!可以复制相关CLSID到注册表中搜索相关CLSID,找到后打开InprocServer32可以看到相关文件的路径,至于DLL文件等可以用UEDIT32.exe工具打开查看具体信息,当然也可以用修改程序类的eXeScope.exe研究一下!
打开注册表项到:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\可以看到下面有一些CLSID值,这些值对应相关的插件,点击可以在默认值后看到相关插件的名称!可以复制相关CLSID到注册表中搜索相关CLSID,找到后打开InprocServer32可以看到相关文件的路径,至于DLL文件等可以用UEDIT32.exe工具打开查看具体信息,当然也可以用修改程序类的eXeScope.exe研究一下!
请根据具体情况删除相关键值和相关文件!
网络上的一些恶意软件免疫的原理就是根据其CLSID值办到的!不过一些垃圾软件总在变,可以通过手工方法来查看,此只适用于BHO类,不是所有的恶意软件CLSID值都在此注册表下!
HijackThis工具可以检测BHO,其显示值02的就是 O2 - IE浏览器辅助对象(BHO模块)
BHODemon可以查看BHO的详细信息,CLSID值,以及相关的DLL文件,通过扫描注册表来实现的,比手工查看注册表要省事的多,可以禁用BHO!
BHODemon scans your Registry for BHOs, and presents any it finds in a list. By highlighting a BHO in this list, and clicking the "Details" button, you can see information about this BHO, and even disable it if you wish. BHOs are disabled by simply renaming the DLL that houses them. By renaming the DLL, instead of deleting it, you have the option of enabling it later if you wish. Why would you want to do that? Because the program that installed the BHO will not run if it can't find the DLL: Go!Zilla, for example, won't run if you remove its BHOs.
下载地址: [url]http://www.spywareinfo.com/downloads/bhod/bhodmon1.zip[/url]
已知的BHO及CLSID列表:
[url]http://www.castlecops.com/CLSID.html[/url]