Detect BHO enabled state

Disabled: Hkey_current_user\software\microsoft\windows\currentversion\ext\settings\

Enabled: Hkey_current_user\software\microsoft\windows\currentversion\ext\stats\

Example:

1. Disable

Windows Registry Editor Version 5.00

[hkey_current_user\software\microsoft\windows\currentversion\ext\settings\{ C59D3771-0E3E-48B8-97C5-9CD2C091CF09}] "Flags" =dword:00000001 "Version" = "*"

2. Enable

Windows Registry Editor Version 5.00

[Hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{c59d3771-0e3e-48b8-97c5-9cd2c091cf09}]

[Hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{c59d3771-0e3e-48b8-97c5-9cd2c091cf09}\ IEXPLORE] "Type" =dword:00000003 "Flags" =dword:00000000 "Count" =dword:000003e1 "Time" =hex:de,07,0b,00,04,00,1b, 00,0d,00,1e,00,25,00,34,02 "Blocked" =DWORD:000000A3 "Loadtimearray" =HEX:21,89,00,00,D8,00,00,00,3F,01,00,00,DC, 00,00,00,99,06,00,\ 00,ed,00,00,00,f5,00,00,00,00,00,00,00,b2,00,00,00,d3,00,00,00

MSDN Forum Original:

Add the BHO ' s CLSID under hkey_current_user\software\microsoft\windows\currentversion\ext\[settings] and [Stats]; The presence of the CLSID under [Stats] with a subkey of "IEXPLORE" with a Non-zero "Blocked" value of was actually what BL Ocks the object. I Don ' t think the stuff under Hkey_current_user\software\microsoft\windows\currentversion\ext is documented; As I recall, "Time" is the time of the object was last requested, "Count" is how many activation requests has been received for The object, "Blocked" is what many of those requests were Blocked, and "type" is the type of the object (control, extension , BHO, don ' t remember what else). Find the CLSID of a BHO, block that BHO in Manage add-ons, and then clones the values as a starting point.

Detect BHO enabled state