Polish the Enumerate Modules implementation a bit.

1) De-dup the registered DLLs since a lot of the same DLLs will be registered multiple times, ie. mswsock.dll
2) Every module loaded from a %temp% dir should be viewed as suspicious.
3) Add some histogram counters (xml changes coming in a followup CL).

BUG=http://crbug.com/51105
TEST=None

Review URL: http://codereview.chromium.org/5183007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@66880 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 1 deletions

diff --git a/chrome/browser/enumerate_modules_model_win.h b/chrome/browser/enumerate_modules_model_win.h
index 73d05a1..cf65eaf 100644
--- a/chrome/browser/enumerate_modules_model_win.h
+++ b/chrome/browser/enumerate_modules_model_win.h
@@ -81,6 +81,8 @@ class ModuleEnumerator : public base::RefCountedThreadSafe<ModuleEnumerator> {
     string16 digital_signer;
     // The help tips bitmask.
     RecommendedAction recommended_action;
+    // The duplicate count within each category of modules.
+    int duplicate_count;
     // Whether this module has been normalized (necessary before checking it
     // against blacklist).
     bool normalized;
@@ -141,7 +143,7 @@ class ModuleEnumerator : public base::RefCountedThreadSafe<ModuleEnumerator> {
   void EnumerateShellExtensions();
 
   // Enumerate all registered Winsock LSP modules.
-  void EnumerateWinsockModule();
+  void EnumerateWinsockModules();
 
   // Reads the registered shell extensions found under |parent| key in the
   // registry.
@@ -151,6 +153,11 @@ class ModuleEnumerator : public base::RefCountedThreadSafe<ModuleEnumerator> {
   // information using the location field of the module.
   void PopulateModuleInformation(Module* module);
 
+  // Checks the module list to see if a |module| of the same type, location
+  // and name has been added before and if so, increments its duplication
+  // counter. If it doesn't appear in the list, it is added.
+  void AddToListWithoutDuplicating(const Module&);
+
   // Builds up a vector of path values mapping to environment variable,
   // with pairs like [c:\windows\, %systemroot%]. This is later used to
   // collapse paths like c:\windows\system32 into %systemroot%\system32, which