False Positive? : Adobe Acrobat Reader (.pdf) Browser Helper Object (BHO)

J

JRosenfeld

On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
 
G

Guest

On mine, the same tab (Systems Explorer, IE BHOs) is
completely clear. Well it would, wouldn't it, since I
told MsAS to block it :(
There isn't an undo for BHOs like there is for home
page 'hijacks' (= anything that is not MSN!)

I think the key message for the Beta program monitors is
this: the algorithm that detects BHOs needs to say what
it has found and not blackmail the user into shooting
first and asking questions later.
[But presumably that is going to need app signing. If I
were one of the bad guys, I'd call my keystroke
logger "Acrobat Reader" or "Quicktime" or something. I'm
certainly not going to call it "I-wear-a-mask-and-carry-a-
bag-marked-swag.exe"!]

So here goes remove and re-install of Reader :(
-----Original Message-----
On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
-----Original Message-----
The BHO detection algorithm (correctly) finds that there
is a BHO installed, but it doesn't say what it is.
Playing safe, I authorised that it be deleted [itslef a
bit wicked, since I was running as User]. Now I can't
open .pdf content on web sites any more.

Solution seems to be (at least worked for me with AR 7.0)
to switch to Administrator then start up Reader from
Program Files, whereupon it reinstalls the BHO.

So clearly the BHO scanner needs to identify the object,
or at least bring up the Advanced dialogue and have that
do the analysis. Ideally it needs to know that Adobe
Acrobat Reader is safe.
.
.
 
O

observer

Ok, I uninstalled and reinstalled AAR. This time, no
challenge and it is in the BHO list as safe. So looks
like this one has been repaired.
-----Original Message-----
On mine, the same tab (Systems Explorer, IE BHOs) is
completely clear. Well it would, wouldn't it, since I
told MsAS to block it :(
There isn't an undo for BHOs like there is for home
page 'hijacks' (= anything that is not MSN!)

I think the key message for the Beta program monitors is
this: the algorithm that detects BHOs needs to say what
it has found and not blackmail the user into shooting
first and asking questions later.
[But presumably that is going to need app signing. If I
were one of the bad guys, I'd call my keystroke
logger "Acrobat Reader" or "Quicktime" or something. I'm
certainly not going to call it "I-wear-a-mask-and-carry- a-
bag-marked-swag.exe"!]

So here goes remove and re-install of Reader :(
-----Original Message-----
On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
-----Original Message-----
The BHO detection algorithm (correctly) finds that there
is a BHO installed, but it doesn't say what it is.
Playing safe, I authorised that it be deleted [itslef a
bit wicked, since I was running as User]. Now I can't
open .pdf content on web sites any more.

Solution seems to be (at least worked for me with AR 7.0)
to switch to Administrator then start up Reader from
Program Files, whereupon it reinstalls the BHO.

So clearly the BHO scanner needs to identify the object,
or at least bring up the Advanced dialogue and have that
do the analysis. Ideally it needs to know that Adobe
Acrobat Reader is safe.
.
.
.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top