OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/enumerate_modules_model_win.h" | 5 #include "chrome/browser/enumerate_modules_model_win.h" |
6 | 6 |
7 #include <Tlhelp32.h> | 7 #include <Tlhelp32.h> |
8 #include <wintrust.h> | 8 #include <wintrust.h> |
9 #include <algorithm> | 9 #include <algorithm> |
10 | 10 |
11 #include "base/bind.h" | 11 #include "base/bind.h" |
12 #include "base/command_line.h" | 12 #include "base/command_line.h" |
13 #include "base/environment.h" | 13 #include "base/environment.h" |
14 #include "base/file_version_info_win.h" | 14 #include "base/file_version_info_win.h" |
15 #include "base/files/file_path.h" | 15 #include "base/files/file_path.h" |
16 #include "base/i18n/case_conversion.h" | 16 #include "base/i18n/case_conversion.h" |
17 #include "base/metrics/histogram.h" | 17 #include "base/metrics/histogram.h" |
18 #include "base/string_util.h" | 18 #include "base/string_util.h" |
19 #include "base/strings/string_number_conversions.h" | 19 #include "base/strings/string_number_conversions.h" |
20 #include "base/time.h" | 20 #include "base/time.h" |
21 #include "base/utf_string_conversions.h" | 21 #include "base/utf_string_conversions.h" |
22 #include "base/values.h" | 22 #include "base/values.h" |
23 #include "base/version.h" | 23 #include "base/version.h" |
24 #include "base/win/registry.h" | 24 #include "base/win/registry.h" |
25 #include "base/win/scoped_handle.h" | 25 #include "base/win/scoped_handle.h" |
| 26 #include "base/win/windows_version.h" |
26 #include "chrome/browser/net/service_providers_win.h" | 27 #include "chrome/browser/net/service_providers_win.h" |
27 #include "chrome/common/chrome_constants.h" | 28 #include "chrome/common/chrome_constants.h" |
28 #include "chrome/common/chrome_notification_types.h" | 29 #include "chrome/common/chrome_notification_types.h" |
29 #include "chrome/common/chrome_switches.h" | 30 #include "chrome/common/chrome_switches.h" |
30 #include "content/public/browser/notification_service.h" | 31 #include "content/public/browser/notification_service.h" |
31 #include "crypto/sha2.h" | 32 #include "crypto/sha2.h" |
32 #include "grit/generated_resources.h" | 33 #include "grit/generated_resources.h" |
| 34 #include "grit/google_chrome_strings.h" |
33 #include "ui/base/l10n/l10n_util.h" | 35 #include "ui/base/l10n/l10n_util.h" |
34 | 36 |
35 using content::BrowserThread; | 37 using content::BrowserThread; |
36 | 38 |
37 // The period of time (in milliseconds) to wait until checking to see if any | 39 // The period of time (in milliseconds) to wait until checking to see if any |
38 // incompatible modules exist. | 40 // incompatible modules exist. |
39 static const int kModuleCheckDelayMs = 60 * 1000; | 41 static const int kModuleCheckDelayMs = 45 * 1000; |
40 | 42 |
41 // The path to the Shell Extension key in the Windows registry. | 43 // The path to the Shell Extension key in the Windows registry. |
42 static const wchar_t kRegPath[] = | 44 static const wchar_t kRegPath[] = |
43 L"Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved"; | 45 L"Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved"; |
44 | 46 |
45 // Short-hand for things on the blacklist you should simply get rid of. | 47 // Short-hand for things on the blacklist you should simply get rid of. |
46 static const ModuleEnumerator::RecommendedAction kUninstallLink = | 48 static const ModuleEnumerator::RecommendedAction kUninstallLink = |
47 static_cast<ModuleEnumerator::RecommendedAction>( | 49 static_cast<ModuleEnumerator::RecommendedAction>( |
48 ModuleEnumerator::UNINSTALL | ModuleEnumerator::SEE_LINK); | 50 ModuleEnumerator::UNINSTALL | ModuleEnumerator::SEE_LINK); |
49 | 51 |
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
111 // update the list in PreparePathMappings. Filename, Description/Signer, and | 113 // update the list in PreparePathMappings. Filename, Description/Signer, and |
112 // Location must be entered as hashes (see GenerateHash). Filename is mandatory. | 114 // Location must be entered as hashes (see GenerateHash). Filename is mandatory. |
113 // Entries without any Description, Signer info, or Location will never be | 115 // Entries without any Description, Signer info, or Location will never be |
114 // marked as confirmed bad (only as suspicious). | 116 // marked as confirmed bad (only as suspicious). |
115 const ModuleEnumerator::BlacklistEntry ModuleEnumerator::kModuleBlacklist[] = { | 117 const ModuleEnumerator::BlacklistEntry ModuleEnumerator::kModuleBlacklist[] = { |
116 // NOTE: Please keep this list sorted by dll name, then location. | 118 // NOTE: Please keep this list sorted by dll name, then location. |
117 | 119 |
118 // Version 3.2.1.6 seems to be implicated in most cases (and 3.2.2.2 in some). | 120 // Version 3.2.1.6 seems to be implicated in most cases (and 3.2.2.2 in some). |
119 // There is a more recent version available for download. | 121 // There is a more recent version available for download. |
120 // accelerator.dll, "%programfiles%\\speedbit video accelerator\\". | 122 // accelerator.dll, "%programfiles%\\speedbit video accelerator\\". |
121 { "7ba9402f", "c9132d48", "", "", "", kInvestigatingLink }, | 123 { "7ba9402f", "c9132d48", "", "", "", ALL, kInvestigatingLink }, |
122 | 124 |
123 // apiqq0.dll, "%temp%\\". | 125 // apiqq0.dll, "%temp%\\". |
124 { "26134911", "59145acf", "", "", "", kUninstallLink }, | 126 { "26134911", "59145acf", "", "", "", ALL, kUninstallLink }, |
125 | 127 |
126 // arking0.dll, "%systemroot%\\system32\\". | 128 // arking0.dll, "%systemroot%\\system32\\". |
127 { "f5d8f549", "23d01d5b", "", "", "", kUninstallLink }, | 129 { "f5d8f549", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
128 | 130 |
129 // arking1.dll, "%systemroot%\\system32\\". | 131 // arking1.dll, "%systemroot%\\system32\\". |
130 { "c60ca062", "23d01d5b", "", "", "", kUninstallLink }, | 132 { "c60ca062", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
| 133 |
| 134 // aswjsflt.dll, "%ProgramFiles%\\avast software\\avast\\", "AVAST Software". |
| 135 // NOTE: The digital signature of the DLL is double null terminated. |
| 136 // Avast Antivirus prior to version 8.0 would kill the Chrome child process |
| 137 // when blocked from running. |
| 138 { "2ea5422a", "6b3a1b00", "a7db0e0c", "", "8.0", XP, |
| 139 static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) }, |
| 140 |
| 141 // aswjsflt.dll, "%ProgramFiles%\\alwil software\\avast5\\", "AVAST Software". |
| 142 // NOTE: The digital signature of the DLL is double null terminated. |
| 143 // Avast Antivirus prior to version 8.0 would kill the Chrome child process |
| 144 // when blocked from running. |
| 145 { "2ea5422a", "d8686924", "a7db0e0c", "", "8.0", XP, |
| 146 static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) }, |
131 | 147 |
132 // Said to belong to Killer NIC from BigFoot Networks (not verified). Versions | 148 // Said to belong to Killer NIC from BigFoot Networks (not verified). Versions |
133 // 6.0.0.7 and 6.0.0.10 implicated. | 149 // 6.0.0.7 and 6.0.0.10 implicated. |
134 // bfllr.dll, "%systemroot%\\system32\\". | 150 // bfllr.dll, "%systemroot%\\system32\\". |
135 { "6bb57633", "23d01d5b", "", "", "", kInvestigatingLink }, | 151 { "6bb57633", "23d01d5b", "", "", "", ALL, kInvestigatingLink }, |
136 | 152 |
137 // clickpotatolitesahook.dll, "". Different version each report. | 153 // clickpotatolitesahook.dll, "". Different version each report. |
138 { "0396e037.dll", "", "", "", "", kUninstallLink }, | 154 { "0396e037.dll", "", "", "", "", ALL, kUninstallLink }, |
139 | 155 |
140 // cvasds0.dll, "%temp%\\". | 156 // cvasds0.dll, "%temp%\\". |
141 { "5ce0037c", "59145acf", "", "", "", kUninstallLink }, | 157 { "5ce0037c", "59145acf", "", "", "", ALL, kUninstallLink }, |
142 | 158 |
143 // cwalsp.dll, "%systemroot%\\system32\\". | 159 // cwalsp.dll, "%systemroot%\\system32\\". |
144 { "e579a039", "23d01d5b", "", "", "", kUninstallLink }, | 160 { "e579a039", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
145 | 161 |
146 // datamngr.dll (1), "%programfiles%\\searchqu toolbar\\datamngr\\". | 162 // datamngr.dll (1), "%programfiles%\\searchqu toolbar\\datamngr\\". |
147 { "7add320b", "470a3da3", "", "", "", kUninstallLink }, | 163 { "7add320b", "470a3da3", "", "", "", ALL, kUninstallLink }, |
148 | 164 |
149 // datamngr.dll (2), "%programfiles%\\windows searchqu toolbar\\". | 165 // datamngr.dll (2), "%programfiles%\\windows searchqu toolbar\\". |
150 { "7add320b", "7a3c8be3", "", "", "", kUninstallLink }, | 166 { "7add320b", "7a3c8be3", "", "", "", ALL, kUninstallLink }, |
151 | 167 |
152 // dsoqq0.dll, "%temp%\\". | 168 // dsoqq0.dll, "%temp%\\". |
153 { "1c4df325", "59145acf", "", "", "", kUninstallLink }, | 169 { "1c4df325", "59145acf", "", "", "", ALL, kUninstallLink }, |
154 | 170 |
155 // flt.dll, "%programfiles%\\tueagles\\". | 171 // flt.dll, "%programfiles%\\tueagles\\". |
156 { "6d01f4a1", "7935e9c2", "", "", "", kUninstallLink }, | 172 { "6d01f4a1", "7935e9c2", "", "", "", ALL, kUninstallLink }, |
157 | 173 |
158 // This looks like a malware edition of a Brazilian Bank plugin, sometimes | 174 // This looks like a malware edition of a Brazilian Bank plugin, sometimes |
159 // referred to as Malware.Banc.A. | 175 // referred to as Malware.Banc.A. |
160 // gbieh.dll, "%programfiles%\\gbplugin\\". | 176 // gbieh.dll, "%programfiles%\\gbplugin\\". |
161 { "4cb4f2e3", "88e4a3b1", "", "", "", kUninstallLink }, | 177 { "4cb4f2e3", "88e4a3b1", "", "", "", ALL, kUninstallLink }, |
162 | 178 |
163 // hblitesahook.dll. Each report has different version number in location. | 179 // hblitesahook.dll. Each report has different version number in location. |
164 { "5d10b363", "", "", "", "", kUninstallLink }, | 180 { "5d10b363", "", "", "", "", ALL, kUninstallLink }, |
165 | 181 |
166 // icf.dll, "%systemroot%\\system32\\". | 182 // icf.dll, "%systemroot%\\system32\\". |
167 { "303825ed", "23d01d5b", "", "", "", INVESTIGATING }, | 183 { "303825ed", "23d01d5b", "", "", "", ALL, INVESTIGATING }, |
168 | 184 |
169 // idmmbc.dll (IDM), "%systemroot%\\system32\\". See: http://crbug.com/26892/. | 185 // idmmbc.dll (IDM), "%systemroot%\\system32\\". See: http://crbug.com/26892/. |
170 { "b8dce5c3", "23d01d5b", "", "", "6.03", | 186 { "b8dce5c3", "23d01d5b", "", "", "6.03", ALL, |
171 static_cast<RecommendedAction>(UPDATE | DISABLE) }, | 187 static_cast<RecommendedAction>(UPDATE | DISABLE) }, |
172 | 188 |
173 // imon.dll (NOD32), "%systemroot%\\system32\\". See: http://crbug.com/21715. | 189 // imon.dll (NOD32), "%systemroot%\\system32\\". See: http://crbug.com/21715. |
174 { "8f42f22e", "23d01d5b", "", "", "4.0", | 190 { "8f42f22e", "23d01d5b", "", "", "4.0", ALL, |
175 static_cast<RecommendedAction>(UPDATE | DISABLE) }, | 191 static_cast<RecommendedAction>(UPDATE | DISABLE) }, |
176 | 192 |
177 // is3lsp.dll, "%commonprogramfiles%\\is3\\anti-spyware\\". | 193 // is3lsp.dll, "%commonprogramfiles%\\is3\\anti-spyware\\". |
178 { "7ffbdce9", "bc5673f2", "", "", "", | 194 { "7ffbdce9", "bc5673f2", "", "", "", ALL, |
179 static_cast<RecommendedAction>(UPDATE | DISABLE | SEE_LINK) }, | 195 static_cast<RecommendedAction>(UPDATE | DISABLE | SEE_LINK) }, |
180 | 196 |
181 // jsi.dll, "%programfiles%\\profilecraze\\". | 197 // jsi.dll, "%programfiles%\\profilecraze\\". |
182 { "f9555eea", "e3548061", "", "", "", kUninstallLink }, | 198 { "f9555eea", "e3548061", "", "", "", ALL, kUninstallLink }, |
183 | 199 |
184 // kernel.dll, "%programfiles%\\contentwatch\\internet protection\\modules\\". | 200 // kernel.dll, "%programfiles%\\contentwatch\\internet protection\\modules\\". |
185 { "ead2768e", "4e61ce60", "", "", "", INVESTIGATING }, | 201 { "ead2768e", "4e61ce60", "", "", "", ALL, INVESTIGATING }, |
186 | 202 |
187 // mgking0.dll, "%systemroot%\\system32\\". | 203 // mgking0.dll, "%systemroot%\\system32\\". |
188 { "d0893e38", "23d01d5b", "", "", "", kUninstallLink }, | 204 { "d0893e38", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
189 | 205 |
190 // mgking0.dll, "%temp%\\". | 206 // mgking0.dll, "%temp%\\". |
191 { "d0893e38", "59145acf", "", "", "", kUninstallLink }, | 207 { "d0893e38", "59145acf", "", "", "", ALL, kUninstallLink }, |
192 | 208 |
193 // mgking1.dll, "%systemroot%\\system32\\". | 209 // mgking1.dll, "%systemroot%\\system32\\". |
194 { "3e837222", "23d01d5b", "", "", "", kUninstallLink }, | 210 { "3e837222", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
195 | 211 |
196 // mgking1.dll, "%temp%\\". | 212 // mgking1.dll, "%temp%\\". |
197 { "3e837222", "59145acf", "", "", "", kUninstallLink }, | 213 { "3e837222", "59145acf", "", "", "", ALL, kUninstallLink }, |
198 | 214 |
199 // mstcipha.ime, "%systemroot%\\system32\\". | 215 // mstcipha.ime, "%systemroot%\\system32\\". |
200 { "5523579e", "23d01d5b", "", "", "", INVESTIGATING }, | 216 { "5523579e", "23d01d5b", "", "", "", ALL, INVESTIGATING }, |
201 | 217 |
202 // mwtsp.dll, "%systemroot%\\system32\\". | 218 // mwtsp.dll, "%systemroot%\\system32\\". |
203 { "9830bff6", "23d01d5b", "", "", "", kUninstallLink }, | 219 { "9830bff6", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
204 | 220 |
205 // nodqq0.dll, "%temp%\\". | 221 // nodqq0.dll, "%temp%\\". |
206 { "b86ce04d", "59145acf", "", "", "", kUninstallLink }, | 222 { "b86ce04d", "59145acf", "", "", "", ALL, kUninstallLink }, |
207 | 223 |
208 // nProtect GameGuard Anti-cheat system. Every report has a different | 224 // nProtect GameGuard Anti-cheat system. Every report has a different |
209 // location, since it is installed into and run from a game folder. Various | 225 // location, since it is installed into and run from a game folder. Various |
210 // versions implicated. | 226 // versions implicated. |
211 // npggnt.des, no fixed location. | 227 // npggnt.des, no fixed location. |
212 { "f2c8790d", "", "", "", "", kInvestigatingLink }, | 228 { "f2c8790d", "", "", "", "", ALL, kInvestigatingLink }, |
213 | 229 |
214 // nvlsp.dll, | 230 // nvlsp.dll, |
215 // "%programfiles%\\nvidia corporation\\networkaccessmanager\\bin32\\". | 231 // "%programfiles%\\nvidia corporation\\networkaccessmanager\\bin32\\". |
216 { "37f907e2", "3ad0ff23", "", "", "", INVESTIGATING }, | 232 { "37f907e2", "3ad0ff23", "", "", "", ALL, INVESTIGATING }, |
217 | 233 |
218 // post0.dll, "%systemroot%\\system32\\". | 234 // post0.dll, "%systemroot%\\system32\\". |
219 { "7405c0c8", "23d01d5b", "", "", "", kUninstallLink }, | 235 { "7405c0c8", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
220 | 236 |
221 // questbrwsearch.dll, "%programfiles%\\questbrwsearch\\". | 237 // questbrwsearch.dll, "%programfiles%\\questbrwsearch\\". |
222 { "0953ed09", "f0d5eeda", "", "", "", kUninstallLink }, | 238 { "0953ed09", "f0d5eeda", "", "", "", ALL, kUninstallLink }, |
223 | 239 |
224 // questscan.dll, "%programfiles%\\questscan\\". | 240 // questscan.dll, "%programfiles%\\questscan\\". |
225 { "f4f3391e", "119d20f7", "", "", "", kUninstallLink }, | 241 { "f4f3391e", "119d20f7", "", "", "", ALL, kUninstallLink }, |
226 | 242 |
227 // radhslib.dll (Naomi web filter), "%programfiles%\\rnamfler\\". | 243 // radhslib.dll (Naomi web filter), "%programfiles%\\rnamfler\\". |
228 // See http://crbug.com/12517. | 244 // See http://crbug.com/12517. |
229 { "7edcd250", "0733dc3e", "", "", "", INVESTIGATING }, | 245 { "7edcd250", "0733dc3e", "", "", "", ALL, INVESTIGATING }, |
230 | 246 |
231 // rlls.dll, "%programfiles%\\relevantknowledge\\". | 247 // rlls.dll, "%programfiles%\\relevantknowledge\\". |
232 { "a1ed94a7", "ea9d6b36", "", "", "", kUninstallLink }, | 248 { "a1ed94a7", "ea9d6b36", "", "", "", ALL, kUninstallLink }, |
233 | 249 |
234 // rooksdol.dll, "%programfiles%\\trusteer\\rapport\\bin\\". | 250 // rooksdol.dll, "%programfiles%\\trusteer\\rapport\\bin\\". |
235 { "802aefef", "06120e13", "", "", "3.5.1008.40", UPDATE }, | 251 { "802aefef", "06120e13", "", "", "3.5.1008.40", ALL, UPDATE }, |
236 | 252 |
237 // scanquery.dll, "%programfiles%\\scanquery\\". | 253 // scanquery.dll, "%programfiles%\\scanquery\\". |
238 { "0b52d2ae", "a4cc88b1", "", "", "", kUninstallLink }, | 254 { "0b52d2ae", "a4cc88b1", "", "", "", ALL, kUninstallLink }, |
239 | 255 |
240 // sdata.dll, "%programdata%\\srtserv\\". | 256 // sdata.dll, "%programdata%\\srtserv\\". |
241 { "1936d5cc", "223c44be", "", "", "", kUninstallLink }, | 257 { "1936d5cc", "223c44be", "", "", "", ALL, kUninstallLink }, |
242 | 258 |
243 // searchtree.dll, | 259 // searchtree.dll, |
244 // "%programfiles%\\contentwatch\\internet protection\\modules\\". | 260 // "%programfiles%\\contentwatch\\internet protection\\modules\\". |
245 { "f6915a31", "4e61ce60", "", "", "", INVESTIGATING }, | 261 { "f6915a31", "4e61ce60", "", "", "", ALL, INVESTIGATING }, |
246 | 262 |
247 // sgprxy.dll, "%commonprogramfiles%\\is3\\anti-spyware\\". | 263 // sgprxy.dll, "%commonprogramfiles%\\is3\\anti-spyware\\". |
248 { "005965ea", "bc5673f2", "", "", "", INVESTIGATING }, | 264 { "005965ea", "bc5673f2", "", "", "", ALL, INVESTIGATING }, |
| 265 |
| 266 // snxhk.dll, "%ProgramFiles%\\avast software\\avast\\", "AVAST Software". |
| 267 // NOTE: The digital signature of the DLL is double null terminated. |
| 268 // Avast Antivirus prior to version 8.0 would kill the Chrome child process |
| 269 // when blocked from running. |
| 270 { "46c16aa8", "6b3a1b00", "a7db0e0c", "", "8.0", XP, |
| 271 static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) }, |
| 272 |
| 273 // snxhk.dll, "%ProgramFiles%\\alwil software\\avast5\\", "AVAST Software". |
| 274 // NOTE: The digital signature of the DLL is double null terminated. |
| 275 // Avast Antivirus prior to version 8.0 would kill the Chrome child process |
| 276 // when blocked from running. |
| 277 { "46c16aa8", "d8686924", "a7db0e0c", "", "8.0", XP, |
| 278 static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) }, |
249 | 279 |
250 // sprotector.dll, "". Different location each report. | 280 // sprotector.dll, "". Different location each report. |
251 { "24555d74", "", "", "", "", kUninstallLink }, | 281 { "24555d74", "", "", "", "", ALL, kUninstallLink }, |
252 | 282 |
253 // swi_filter_0001.dll (Sophos Web Intelligence), | 283 // swi_filter_0001.dll (Sophos Web Intelligence), |
254 // "%programfiles%\\sophos\\sophos anti-virus\\web intelligence\\". | 284 // "%programfiles%\\sophos\\sophos anti-virus\\web intelligence\\". |
255 // A small random sample all showed version 1.0.5.0. | 285 // A small random sample all showed version 1.0.5.0. |
256 { "61112d7b", "25fb120f", "", "", "", kInvestigatingLink }, | 286 { "61112d7b", "25fb120f", "", "", "", ALL, kInvestigatingLink }, |
257 | 287 |
258 // twking0.dll, "%systemroot%\\system32\\". | 288 // twking0.dll, "%systemroot%\\system32\\". |
259 { "0355549b", "23d01d5b", "", "", "", kUninstallLink }, | 289 { "0355549b", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
260 | 290 |
261 // twking1.dll, "%systemroot%\\system32\\". | 291 // twking1.dll, "%systemroot%\\system32\\". |
262 { "02e44508", "23d01d5b", "", "", "", kUninstallLink }, | 292 { "02e44508", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
263 | 293 |
264 // vksaver.dll, "%systemroot%\\system32\\". | 294 // vksaver.dll, "%systemroot%\\system32\\". |
265 { "c4a784d5", "23d01d5b", "", "", "", kUninstallLink }, | 295 { "c4a784d5", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
266 | 296 |
267 // vlsp.dll (Venturi Firewall?), "%systemroot%\\system32\\". | 297 // vlsp.dll (Venturi Firewall?), "%systemroot%\\system32\\". |
268 { "2e4eb93d", "23d01d5b", "", "", "", INVESTIGATING }, | 298 { "2e4eb93d", "23d01d5b", "", "", "", ALL, INVESTIGATING }, |
269 | 299 |
270 // vmn3_1dn.dll, "%appdata%\\roaming\\vmndtxtb\\". | 300 // vmn3_1dn.dll, "%appdata%\\roaming\\vmndtxtb\\". |
271 { "bba2037d", "9ab68585", "", "", "", kUninstallLink }, | 301 { "bba2037d", "9ab68585", "", "", "", ALL, kUninstallLink }, |
272 | 302 |
273 // webanalyzer.dll, | 303 // webanalyzer.dll, |
274 // "%programfiles%\\contentwatch\\internet protection\\modules\\". | 304 // "%programfiles%\\contentwatch\\internet protection\\modules\\". |
275 { "c70b697d", "4e61ce60", "", "", "", INVESTIGATING }, | 305 { "c70b697d", "4e61ce60", "", "", "", ALL, INVESTIGATING }, |
276 | 306 |
277 // wowst0.dll, "%systemroot%\\system32\\". | 307 // wowst0.dll, "%systemroot%\\system32\\". |
278 { "38ad9963", "23d01d5b", "", "", "", kUninstallLink }, | 308 { "38ad9963", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
279 | 309 |
280 // wxbase28u_vc_cw.dll, "%systemroot%\\system32\\". | 310 // wxbase28u_vc_cw.dll, "%systemroot%\\system32\\". |
281 { "e967210d", "23d01d5b", "", "", "", kUninstallLink }, | 311 { "e967210d", "23d01d5b", "", "", "", ALL, kUninstallLink }, |
282 }; | 312 }; |
283 | 313 |
284 // Generates an 8 digit hash from the input given. | 314 // Generates an 8 digit hash from the input given. |
285 static void GenerateHash(const std::string& input, std::string* output) { | 315 static void GenerateHash(const std::string& input, std::string* output) { |
286 if (input.empty()) { | 316 if (input.empty()) { |
287 *output = ""; | 317 *output = ""; |
288 return; | 318 return; |
289 } | 319 } |
290 | 320 |
291 uint8 hash[4]; | 321 uint8 hash[4]; |
(...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
327 ModuleEnumerator::ModuleStatus ModuleEnumerator::Match( | 357 ModuleEnumerator::ModuleStatus ModuleEnumerator::Match( |
328 const ModuleEnumerator::Module& module, | 358 const ModuleEnumerator::Module& module, |
329 const ModuleEnumerator::BlacklistEntry& blacklisted) { | 359 const ModuleEnumerator::BlacklistEntry& blacklisted) { |
330 // All modules must be normalized before matching against blacklist. | 360 // All modules must be normalized before matching against blacklist. |
331 DCHECK(module.normalized); | 361 DCHECK(module.normalized); |
332 // Filename is mandatory and version should not contain spaces. | 362 // Filename is mandatory and version should not contain spaces. |
333 DCHECK(strlen(blacklisted.filename) > 0); | 363 DCHECK(strlen(blacklisted.filename) > 0); |
334 DCHECK(!strstr(blacklisted.version_from, " ")); | 364 DCHECK(!strstr(blacklisted.version_from, " ")); |
335 DCHECK(!strstr(blacklisted.version_to, " ")); | 365 DCHECK(!strstr(blacklisted.version_to, " ")); |
336 | 366 |
| 367 base::win::Version version = base::win::GetVersion(); |
| 368 switch (version) { |
| 369 case base::win::VERSION_XP: |
| 370 if (!(blacklisted.os & XP)) return NOT_MATCHED; |
| 371 break; |
| 372 default: |
| 373 break; |
| 374 } |
| 375 |
337 std::string filename_hash, location_hash; | 376 std::string filename_hash, location_hash; |
338 GenerateHash(WideToUTF8(module.name), &filename_hash); | 377 GenerateHash(WideToUTF8(module.name), &filename_hash); |
339 GenerateHash(WideToUTF8(module.location), &location_hash); | 378 GenerateHash(WideToUTF8(module.location), &location_hash); |
340 | 379 |
341 // Filenames are mandatory. Location is mandatory if given. | 380 // Filenames are mandatory. Location is mandatory if given. |
342 if (filename_hash == blacklisted.filename && | 381 if (filename_hash == blacklisted.filename && |
343 (std::string(blacklisted.location).empty() || | 382 (std::string(blacklisted.location).empty() || |
344 location_hash == blacklisted.location)) { | 383 location_hash == blacklisted.location)) { |
345 // We have a name match against the blacklist (and possibly location match | 384 // We have a name match against the blacklist (and possibly location match |
346 // also), so check version. | 385 // also), so check version. |
(...skipping 20 matching lines...) Expand all Loading... |
367 GenerateHash(WideToUTF8(module.digital_signer), &signer_hash); | 406 GenerateHash(WideToUTF8(module.digital_signer), &signer_hash); |
368 GenerateHash(WideToUTF8(module.description), &description_hash); | 407 GenerateHash(WideToUTF8(module.description), &description_hash); |
369 | 408 |
370 // If signatures match (or both are empty), then we have a winner. | 409 // If signatures match (or both are empty), then we have a winner. |
371 if (signer_hash == desc_or_signer) | 410 if (signer_hash == desc_or_signer) |
372 return CONFIRMED_BAD; | 411 return CONFIRMED_BAD; |
373 | 412 |
374 // If descriptions match (or both are empty) and the locations match, then | 413 // If descriptions match (or both are empty) and the locations match, then |
375 // we also have a confirmed match. | 414 // we also have a confirmed match. |
376 if (description_hash == desc_or_signer && | 415 if (description_hash == desc_or_signer && |
377 !location_hash.empty() && location_hash == blacklisted.location) { | 416 !location_hash.empty() && location_hash == blacklisted.location) |
378 return CONFIRMED_BAD; | 417 return CONFIRMED_BAD; |
379 } | |
380 | 418 |
381 // We are not sure, but it is likely bad. | 419 // We are not sure, but it is likely bad. |
382 return SUSPECTED_BAD; | 420 return SUSPECTED_BAD; |
383 } | 421 } |
384 } | 422 } |
385 | 423 |
386 return NOT_MATCHED; | 424 return NOT_MATCHED; |
387 } | 425 } |
388 | 426 |
389 ModuleEnumerator::ModuleEnumerator(EnumerateModulesModel* observer) | 427 ModuleEnumerator::ModuleEnumerator(EnumerateModulesModel* observer) |
(...skipping 379 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
769 return subject_name; | 807 return subject_name; |
770 } | 808 } |
771 | 809 |
772 // ---------------------------------------------------------------------------- | 810 // ---------------------------------------------------------------------------- |
773 | 811 |
774 // static | 812 // static |
775 EnumerateModulesModel* EnumerateModulesModel::GetInstance() { | 813 EnumerateModulesModel* EnumerateModulesModel::GetInstance() { |
776 return Singleton<EnumerateModulesModel>::get(); | 814 return Singleton<EnumerateModulesModel>::get(); |
777 } | 815 } |
778 | 816 |
| 817 // static |
| 818 void EnumerateModulesModel::RecordLearnMoreStat(bool from_menu) { |
| 819 UMA_HISTOGRAM_ENUMERATION("ConflictingModule.UserSelection", |
| 820 from_menu ? ACTION_MENU_LEARN_MORE : ACTION_BUBBLE_LEARN_MORE, |
| 821 ACTION_BOUNDARY); |
| 822 } |
| 823 |
779 bool EnumerateModulesModel::ShouldShowConflictWarning() const { | 824 bool EnumerateModulesModel::ShouldShowConflictWarning() const { |
780 // If the user has acknowledged the conflict notification, then we don't need | 825 // If the user has acknowledged the conflict notification, then we don't need |
781 // to show it again (because the scanning only happens once per the lifetime | 826 // to show it again (because the scanning only happens once per the lifetime |
782 // of the process). If we were to run the scanning more than once, then we'd | 827 // of the process). If we were to run the scanning more than once, then we'd |
783 // need to clear the flag somewhere when we are ready to show it again. | 828 // need to clear the flag somewhere when we are ready to show it again. |
784 if (conflict_notification_acknowledged_) | 829 if (conflict_notification_acknowledged_) |
785 return false; | 830 return false; |
786 | 831 |
787 return confirmed_bad_modules_detected_ > 0; | 832 return confirmed_bad_modules_detected_ > 0; |
788 } | 833 } |
(...skipping 105 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
894 ConstructHelpCenterUrl(*module).spec().c_str()); | 939 ConstructHelpCenterUrl(*module).spec().c_str()); |
895 } | 940 } |
896 | 941 |
897 list->Append(data); | 942 list->Append(data); |
898 } | 943 } |
899 | 944 |
900 lock->Release(); | 945 lock->Release(); |
901 return list; | 946 return list; |
902 } | 947 } |
903 | 948 |
| 949 GURL EnumerateModulesModel::GetFirstNotableConflict() { |
| 950 lock->Acquire(); |
| 951 GURL url; |
| 952 |
| 953 if (enumerated_modules_.empty()) { |
| 954 lock->Release(); |
| 955 return GURL(); |
| 956 } |
| 957 |
| 958 for (ModuleEnumerator::ModulesVector::const_iterator module = |
| 959 enumerated_modules_.begin(); |
| 960 module != enumerated_modules_.end(); ++module) { |
| 961 if (!(module->recommended_action & ModuleEnumerator::NOTIFY_USER)) |
| 962 continue; |
| 963 |
| 964 url = ConstructHelpCenterUrl(*module); |
| 965 DCHECK(url.is_valid()); |
| 966 break; |
| 967 } |
| 968 |
| 969 lock->Release(); |
| 970 return url; |
| 971 } |
| 972 |
| 973 |
904 EnumerateModulesModel::EnumerateModulesModel() | 974 EnumerateModulesModel::EnumerateModulesModel() |
905 : limited_mode_(false), | 975 : limited_mode_(false), |
906 scanning_(false), | 976 scanning_(false), |
907 conflict_notification_acknowledged_(false), | 977 conflict_notification_acknowledged_(false), |
908 confirmed_bad_modules_detected_(0), | 978 confirmed_bad_modules_detected_(0), |
909 suspected_bad_modules_detected_(0) { | 979 suspected_bad_modules_detected_(0), |
910 const CommandLine& cmd_line = *CommandLine::ForCurrentProcess(); | 980 modules_to_notify_about_(0) { |
911 if (cmd_line.HasSwitch(switches::kConflictingModulesCheck)) { | |
912 check_modules_timer_.Start(FROM_HERE, | |
913 base::TimeDelta::FromMilliseconds(kModuleCheckDelayMs), | |
914 this, &EnumerateModulesModel::ScanNow); | |
915 } | |
916 | |
917 lock = new base::Lock(); | 981 lock = new base::Lock(); |
918 } | 982 } |
919 | 983 |
920 EnumerateModulesModel::~EnumerateModulesModel() { | 984 EnumerateModulesModel::~EnumerateModulesModel() { |
921 delete lock; | 985 delete lock; |
922 } | 986 } |
923 | 987 |
| 988 void EnumerateModulesModel::MaybePostScanningTask() { |
| 989 static bool done = false; |
| 990 if (!done) { |
| 991 done = true; |
| 992 |
| 993 const CommandLine& cmd_line = *CommandLine::ForCurrentProcess(); |
| 994 if (cmd_line.HasSwitch(switches::kConflictingModulesCheck) || |
| 995 base::win::GetVersion() == base::win::VERSION_XP) { |
| 996 check_modules_timer_.Start(FROM_HERE, |
| 997 base::TimeDelta::FromMilliseconds(kModuleCheckDelayMs), |
| 998 this, &EnumerateModulesModel::ScanNow); |
| 999 } |
| 1000 } |
| 1001 } |
| 1002 |
924 void EnumerateModulesModel::DoneScanning() { | 1003 void EnumerateModulesModel::DoneScanning() { |
925 confirmed_bad_modules_detected_ = 0; | 1004 confirmed_bad_modules_detected_ = 0; |
926 suspected_bad_modules_detected_ = 0; | 1005 suspected_bad_modules_detected_ = 0; |
| 1006 modules_to_notify_about_ = 0; |
927 for (ModuleEnumerator::ModulesVector::const_iterator module = | 1007 for (ModuleEnumerator::ModulesVector::const_iterator module = |
928 enumerated_modules_.begin(); | 1008 enumerated_modules_.begin(); |
929 module != enumerated_modules_.end(); ++module) { | 1009 module != enumerated_modules_.end(); ++module) { |
930 if (module->status == ModuleEnumerator::CONFIRMED_BAD) | 1010 if (module->status == ModuleEnumerator::CONFIRMED_BAD) { |
931 ++confirmed_bad_modules_detected_; | 1011 ++confirmed_bad_modules_detected_; |
932 if (module->status == ModuleEnumerator::SUSPECTED_BAD) | 1012 if (module->recommended_action & ModuleEnumerator::NOTIFY_USER) |
933 ++suspected_bad_modules_detected_; | 1013 ++modules_to_notify_about_; |
| 1014 } else if (module->status == ModuleEnumerator::SUSPECTED_BAD) { |
| 1015 ++suspected_bad_modules_detected_; |
| 1016 if (module->recommended_action & ModuleEnumerator::NOTIFY_USER) |
| 1017 ++modules_to_notify_about_; |
| 1018 } |
934 } | 1019 } |
935 | 1020 |
936 scanning_ = false; | 1021 scanning_ = false; |
937 lock->Release(); | 1022 lock->Release(); |
938 | 1023 |
939 UMA_HISTOGRAM_COUNTS_100("Conflicts.SuspectedBadModules", | 1024 UMA_HISTOGRAM_COUNTS_100("Conflicts.SuspectedBadModules", |
940 suspected_bad_modules_detected_); | 1025 suspected_bad_modules_detected_); |
941 UMA_HISTOGRAM_COUNTS_100("Conflicts.ConfirmedBadModules", | 1026 UMA_HISTOGRAM_COUNTS_100("Conflicts.ConfirmedBadModules", |
942 confirmed_bad_modules_detected_); | 1027 confirmed_bad_modules_detected_); |
943 | 1028 |
(...skipping 14 matching lines...) Expand all Loading... |
958 return; | 1043 return; |
959 | 1044 |
960 content::NotificationService::current()->Notify( | 1045 content::NotificationService::current()->Notify( |
961 chrome::NOTIFICATION_MODULE_INCOMPATIBILITY_BADGE_CHANGE, | 1046 chrome::NOTIFICATION_MODULE_INCOMPATIBILITY_BADGE_CHANGE, |
962 content::Source<EnumerateModulesModel>(this), | 1047 content::Source<EnumerateModulesModel>(this), |
963 content::NotificationService::NoDetails()); | 1048 content::NotificationService::NoDetails()); |
964 } | 1049 } |
965 | 1050 |
966 GURL EnumerateModulesModel::ConstructHelpCenterUrl( | 1051 GURL EnumerateModulesModel::ConstructHelpCenterUrl( |
967 const ModuleEnumerator::Module& module) const { | 1052 const ModuleEnumerator::Module& module) const { |
968 if (!(module.recommended_action & ModuleEnumerator::SEE_LINK)) | 1053 if (!(module.recommended_action & ModuleEnumerator::SEE_LINK) && |
| 1054 !(module.recommended_action & ModuleEnumerator::NOTIFY_USER)) |
969 return GURL(); | 1055 return GURL(); |
970 | 1056 |
971 // Construct the needed hashes. | 1057 // Construct the needed hashes. |
972 std::string filename, location, description, signer; | 1058 std::string filename, location, description, signer; |
973 GenerateHash(WideToUTF8(module.name), &filename); | 1059 GenerateHash(WideToUTF8(module.name), &filename); |
974 GenerateHash(WideToUTF8(module.location), &location); | 1060 GenerateHash(WideToUTF8(module.location), &location); |
975 GenerateHash(WideToUTF8(module.description), &description); | 1061 GenerateHash(WideToUTF8(module.description), &description); |
976 GenerateHash(WideToUTF8(module.digital_signer), &signer); | 1062 GenerateHash(WideToUTF8(module.digital_signer), &signer); |
977 | 1063 |
978 string16 url = l10n_util::GetStringFUTF16(IDS_HELP_CENTER_VIEW_CONFLICTS, | 1064 string16 url = l10n_util::GetStringFUTF16(IDS_HELP_CENTER_VIEW_CONFLICTS, |
979 ASCIIToUTF16(filename), ASCIIToUTF16(location), | 1065 ASCIIToUTF16(filename), ASCIIToUTF16(location), |
980 ASCIIToUTF16(description), ASCIIToUTF16(signer)); | 1066 ASCIIToUTF16(description), ASCIIToUTF16(signer)); |
981 return GURL(UTF16ToUTF8(url)); | 1067 return GURL(UTF16ToUTF8(url)); |
982 } | 1068 } |
OLD | NEW |