False Positive? : Adobe Acrobat Reader (.pdf) Browser Helper Object (BHO)

  • Thread starter Thread starter JRosenfeld
  • Start date Start date
J

JRosenfeld

On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
 
On mine, the same tab (Systems Explorer, IE BHOs) is
completely clear. Well it would, wouldn't it, since I
told MsAS to block it :(
There isn't an undo for BHOs like there is for home
page 'hijacks' (= anything that is not MSN!)

I think the key message for the Beta program monitors is
this: the algorithm that detects BHOs needs to say what
it has found and not blackmail the user into shooting
first and asking questions later.
[But presumably that is going to need app signing. If I
were one of the bad guys, I'd call my keystroke
logger "Acrobat Reader" or "Quicktime" or something. I'm
certainly not going to call it "I-wear-a-mask-and-carry-a-
bag-marked-swag.exe"!]

So here goes remove and re-install of Reader :(
-----Original Message-----
On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
-----Original Message-----
The BHO detection algorithm (correctly) finds that there
is a BHO installed, but it doesn't say what it is.
Playing safe, I authorised that it be deleted [itslef a
bit wicked, since I was running as User]. Now I can't
open .pdf content on web sites any more.

Solution seems to be (at least worked for me with AR 7.0)
to switch to Administrator then start up Reader from
Program Files, whereupon it reinstalls the BHO.

So clearly the BHO scanner needs to identify the object,
or at least bring up the Advanced dialogue and have that
do the analysis. Ideally it needs to know that Adobe
Acrobat Reader is safe.
.
Click to expand...
.
Click to expand...
 
Ok, I uninstalled and reinstalled AAR. This time, no
challenge and it is in the BHO list as safe. So looks
like this one has been repaired.
-----Original Message-----
On mine, the same tab (Systems Explorer, IE BHOs) is
completely clear. Well it would, wouldn't it, since I
told MsAS to block it :(
There isn't an undo for BHOs like there is for home
page 'hijacks' (= anything that is not MSN!)

I think the key message for the Beta program monitors is
this: the algorithm that detects BHOs needs to say what
it has found and not blackmail the user into shooting
first and asking questions later.
[But presumably that is going to need app signing. If I
were one of the bad guys, I'd call my keystroke
logger "Acrobat Reader" or "Quicktime" or something. I'm
certainly not going to call it "I-wear-a-mask-and-carry- a-
bag-marked-swag.exe"!]

So here goes remove and re-install of Reader :(
-----Original Message-----
On my system, Systems Explorer tab, IE BHOs, it correctly
identifies it as AcroIEHlprObj class and marks it as safe.
the dll file it points to is acroiehelper.dll v 7.0.0.1333.
XP SP2, IE 6.0.2900.2180.xpsp_sp2_rtm.0.40803-2158.
-----Original Message-----
The BHO detection algorithm (correctly) finds that there
is a BHO installed, but it doesn't say what it is.
Playing safe, I authorised that it be deleted [itslef a
bit wicked, since I was running as User]. Now I can't
open .pdf content on web sites any more.

Solution seems to be (at least worked for me with AR 7.0)
to switch to Administrator then start up Reader from
Program Files, whereupon it reinstalls the BHO.

So clearly the BHO scanner needs to identify the object,
or at least bring up the Advanced dialogue and have that
do the analysis. Ideally it needs to know that Adobe
Acrobat Reader is safe.
.
Click to expand...
.
Click to expand...
.
Click to expand...
 
Back
Top