China DOS Union

Article author: sakulamu
Article views: 97
Posted at: 1/15 22:44
Article content: Recently I found that when browsing some websites, an IE plug-in from Baidu called "IE Search Companion" gets installed without you even noticing.
This plug-in is extremely strange. Sometimes its signature is baidu.com, and sometimes its signature is Gaoling Interactive Information Technology Corporation limited. Not only is it sneaky, it's also extremely overbearing. IE plug-ins like 3721 only pop up once every few days, but this Baidu plug-in pops up madly every minute and every second without stopping, making it impossible to guard against.

The Baidu plug-in automatically runs the "BIE" process at startup, slows down Internet access, and makes the system run very unstably. On some antivirus software forums, users are condemning this plug-in. Many netizens found that after the Baidu plug-in is installed, it deletes user hard disk data and registry entries without the user's permission, causing some software to fail to run normally. Even more frightening is that this Baidu background program called "BIE" runs hidden, cannot be deleted in the system configuration program, and after its corresponding registry entries are deleted they are automatically restored, exactly the same as the characteristics of a virus. On the Kingsoft Antivirus forum there are also users reporting that the Baidu plug-in conflicts with software such as the China Game Center online client and AV Guard, and often causes IE errors when shutting down.

By analyzing this software's source code, it can be seen that this is a very crudely written Windows application program
#include "windows.h"
#include "winbase.h"
void main()
{
char buf;
::ZeroMemory(buf, MAX_PATH);
::GetWindowsDirectory(buf, MAX_PATH);
char filename;
::ZeroMemory(filename, MAX_PATH);
strcpy(filename, buf);
strcat(filename, "\\Downloaded Program Files\\BDPlugin.dll";
::MoveFileEx(filename, NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
::ZeroMemory(filename, MAX_PATH);
strcpy(filename, buf);
strcat(filename, "\\Downloaded Program Files\\BDHelper.dll";
::MoveFileEx(filename, NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
::ZeroMemory(filename, MAX_PATH);
strcpy(filename, buf);
strcat(filename, "\\Downloaded Program Files\\BDSrHook.dll";
::MoveFileEx(filename, NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
::ZeroMemory(filename, MAX_PATH);
strcpy(filename, buf);
strcat(filename, "\\Downloaded Program Files\\BDEx.dll";
::MoveFileEx(filename, NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
}

But this Baidu IE plug-in cannot be completely uninstalled by normal uninstall methods at all. Below I'll introduce the detailed method for completely uninstalling this plug-in.
Because this Baidu IE plug-in uses Rundll32.exe to call the DLL, the system cannot terminate the Rundll32.exe process, so we must first restart the computer, press F8 to enter Safe Mode (F8 can only be pressed once), then click Start -> Run, type regedit to open the registry, and go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Delete the key: BIE its key value is: Rundll32 C:\WINNT\DOWNLO~1\BDPlugin.dll,Rundll32 (if it is win98, then C:\WINNT\DOWNLO~1\ here is C:\WINDOWS\DOWNLO~1\)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY
Delete the key: BDSEARCH, this key adds the Baidu IE Search Companion option under Internet Options -> Advanced.
HKEY_CLASSES_ROOT
Delete the key: BDHlprObj.BDHlprObj
Delete the key: BDHlprObj.BDHlprObj.1
Delete the key: BDHook.BDSrchHook
Delete the key: BDHook.BDSrchHook.1
Delete the key: BDHook.URLBDHook
Delete the key: BDHook.URLBDHook.1
Delete the key: BDPlugins.Interceptor
Delete the key: BDPlugins.Interceptor.1
HKEY_CLASSES_ROOT\CLSID
Delete the key: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C}
Delete the key: {CA92B524-BC8A-4610-BD2C-6BD3E28155D0}
HKEY_CLASSES_ROOT\TypeLib
Delete the key: {CE7C3CE2-4B15-11D1-ABED-709549C10000}
HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID
Delete the key: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C}
Delete the key: {CA92B524-BC8A-4610-BD2C-6BD3E28155D0}
HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib
Delete the key: {CE7C3CE2-4B15-11D1-ABED-709549C10000}
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units
Delete the key: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C}
Delete the key: {CA92B524-BC8A-4610-BD2C-6BD3E28155D0}
After deleting the items in the registry, you also need to delete the IE Search Companion files stored on the hard disk.
Delete the following files: under the C:\WINNT\DOWNLO~1 directory (under 98 it is under C:\WINDOWS\DOWNLO~1\ same below)
BDEX.DLL 24576 12-25-02 11：43
BDPLUGIN.DLL 49152 12-25-02 11：44
BDSRHOOK.DLL 32768 12-25-02 11：45
BDHELPER.DLL 36864 12-25-02 11：52
BDSEARCH.INF 1507 12-28-02 9：48
Delete all of the above files, and this way the Baidu IE plug-in will basically be completely removed from your computer. Finally, restart the computer and enter normal mode, and you will no longer suffer from the Baidu plug-in.


Below is the method to completely block the Baidu plug-in:
After completely deleting the Baidu plug-in, use the Notepad that comes with Windows to open the hosts file (the hosts file is a text-format file that comes with Windows and maps host names to IP addresses. The hosts file is located at C:\Windows in the Win9x series, at \winnt\system32\drivers\etc on the NT and win2000 platforms, and at \windows\system32\drivers\etc on the Winxp platform. If you can't find it, just search for hosts)

Add the following lines (use one space between the IP and the domain name):

127.0.0.1 bar.baidu.com
127.0.0.1 www.baidu.com
127.0.0.1 baidu.com

Save the file with the name hosts (note, do not add any extension). How about that? You won't see Baidu plug-in dialog boxes anymore, right?
Likewise, the Hosts file can also be used to deal with ads in web pages. Nowadays many large websites have dedicated hosts for storing ads. If you view the web page source code, you can find out which host the ad files are stored on, then use the Hosts file to resolve that host's IP, and you can keep those ads outside the door. The shortcoming of this method is that you won't be able to access the Baidu website, but we all use Google(www.google.com), and the Baidu website has no value to visit anyway.

Also, if there are netizens using multi-page browsers such as NetCaptor, MYIE, QQ Browser, you can also put:
www.baidu.com 202.108.250.228
bar.baidu.com 202.108.250.204
these into the blacklist,
block the whole C segment
202.108.250.*
---------------------------
Hosts attachment included below:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
127.0.0.1 bar.baidu.com #Baidu IE plug-in
127.0.0.1 www.baidu.com #Baidu IE plug-in
127.0.0.1 baidu.com #Baidu IE plug-in

Strange, I use Baidu every day, so how come nothing at all has happened?

I use Baidu a lot, but there is nothing like this in the registry or in the DOWN folder. I use MYIE, and I even changed the GOOGLE plug-in to Baidu.

Could it be because of myie? I use myie too, and occasionally use baidu, and I haven't had any problems.

I use Baidu every day too, but there is no IE Search Companion in IE; under "Advanced" there is only "RealNames."
I've always used real-time antivirus software. Could that be the reason?

Maybe we need to look into under what circumstances one gets infected by the above virus?