phoenix22
Site Admin
Premium Member
Joined: Mar 08, 2002
Posts: 3900
Location: "Div. Stand By"
|
 Posted: Tue Nov 18, 2003 12:08 pm Post subject: Just what the heck is a BHO anyway?? |
 |
|
From the UnderSheriff by Tony (the saint) Klein
"What is a Browser Helper Object?
A Browser Helper Object, or BHO, is just a small program that runs automatically every time you start your Internet browser. Usually, a BHO is installed on your system by another software program. For example, Go!Zilla, the downloading utility, installs a BHO created by Radiate (formerly Aureate Media); this BHO tracks which advertisements you see as you surf the Web.
The natural question is, what do BHOs do? The technical answer is "anything", but generally, it will have something to do with "helping" you browse the Internet.
Of course, many BHOs are what is called "ad-ware" or "spyware": they do things like monitor the websites you visit and report this data back to their creators."
They can also routinely conflict with other running programs, cause a variety of page faults, run time errors, and the like, and generally impede browsing performance.
For those looking for an engrossing read, here's the authoritative MS article:
Browser Helper Objects: The Browser the Way You Want It
A great little tool for viewing and, if required, disabling, the BHOs that may be installed on your machine is BHODemon, which can be downloaded here
We're maintaing a comprehensive list of all known BHO's and Toolbar CLSIDs, which can be viewed here:
http://www.sysinfo.org/bhoinfo.php
It is continuously being updated.
Listed BHO's and Toolbar Class IDs are tagged X for certified spyware/foistware, or other malware, L for legitimate items, O for 'open to debate' and ? for items of unknown status.
NOTE: The Notorious LOP foistware now creates random Browser plugin identifiers as well as file names.
They'll look something like this:
{1A35419C-7394-4989-B3C5-6189EB06BD66} - ssshwckfrngl.dll
or
{9633C13D-85BB-4271-83C1-F22BC2938585} - llbrquistglc.dll
or
{DCF6B0CF-5312-42B2-B783-971C107F8B91} - kstilypsm.dll
As the number of possible names and combinations could therefore literally run into the billions, I will no longer be adding LOP BHOs to the list.
Be watchful when running into unknown BHOs bearing these kinds of fancy names. If they're not on the list, and the file is located in the Application Data directory, it's almost certainly a LOP BHO
The same now goes for Adgoblin/InContext and WurldMedia Browser Plugins, and there are others. Here are some examples of random WurldMedia identifiers and file names:
{8A79D959-1251-41CC-B29D-4CF8B675D41E}: toalundg.dll
{BFAE1995-4CAC-40D0-B029-42CEC449E838}: ecule.dll
and some semi-random ones:
{E0634852-5A3C-4E35-954C-17A0622F0BF8} - m030206pohs.dll
{6270DFC1-EDFB-4BC4-BE8C-842740BA290B}: MOAA030425S.DLL
{BFBAE8DA-9920-4166-A5A4-EBD03F59ABF5}: mo030414s.dll
_________________
"De Oppresso Liber" (We Liberate the Oppressed) Holy Shinola Bat Babe! "Phoenix Flight"....for Buddy...who lived it! |
|
You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0.
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
