Cleaning up after WMF exploit – BHO removal



Browser helper objects (BHO’s) are listed in the registry and load with explorer when it runs (Internet Explorer/ File explorer are so closely tied it affects both.) I’ve used BHOdemon in the past to identify and disable BHO’s and a tool like that is the preferred method. However, in my case, this is a disposable virtual machine and I used the “blunt object” approach…. regedit.


I had identified one file in the infestation as a BHO by viewing it with a text editor and finding a text string identifying that it was a BHO. 3.00.13.dll was the file name. In the registry, I went to the following key HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects and deleted every entry. This is not the recommended way of dealing with it, but I was already several hours into cleaning up my virtual machine and didn’t have any “good” BHO’s that I was concerned that would disable.

Even if there were “good” BHO’s that I had disabled I would image a reinstall of the BHO would fix it. (Some good one’s for example might be an Acrobat reader BHO)… Anyway, I had forgot to detail that step in the earlier writeups and wanted to make sure there was a complete accounting.

Related Posts

Blog Traffic Exchange Related Posts
  • Virtual machine as a safe browsing environment I mentioned this in my summary yesterday morning as a possible workaround until there are patches for the WMF vulnerability that's been big news the last week. I notice that incidents.org has mentioned it too as a possibility today. VMware has released VMPLayer as a free way of running premade......
  • Virtual Machine of a real hard drive This incidents.org article the other day caught my eye. It talked of a utility calledliveview that could take a hard drive (or image of a drive) and make it into a virtual machine for use in vmware (saving all changes to a temporary file so the original structure of the......
  • Internet Explorer in standalone mode? Now, it can be useful to run several versions of the same program at the same time (especially if it's a web browser.) I've accomplished this under linux with internet explorer, but didn't realize there was a way to do so on Windows. Sunbelt blog found a good guide to......
Blog Traffic Exchange Related Websites
  • Free Success Ebook: “The Human Machine” by Arnold Bennett (6th Ed. 1913) – Free Download It has never struck you that you possess a machine?  That machine is yourself – you are the most fascinating bit of machinery that ever was.  Considering that we have to spend the whole of our lives in this human machine, considering that it is our sole means of contact......
  • Create Autorun for your CD's and DVD's The compact disk drive auto play feature, common to most operating systems, is a good way to simplify user experience. Auto play is controlled by a simple text-only file called autorun.inf. While there are dozens of software utilities available that will help you create the file, all you really need......
  • FTP And Other File Transfer Tools In Web Hosting Anything related to the Internet or computers is bound to introduce technical issues pretty soon. One of the earliest that novice web site owners encounter is FTP, which is an acronym for File Transfer Protocol. Seeing it spelled out, it's easy to see why those in the know quickly move......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site