One is
'No Chrome Offer Until'. This one's author is written google.
Another one is
'Smart Cards and Terminals'. This one author written Schlumberger.
(I have another varied name of Spybot - Search & Destroy too. But, i will ask about it in the Spybot - Search & Destroy section.)
The program is this much name.... 'No Chrome Offer Until'. Can it be chrome? I never installed google chrome, but i have a chrome folder in c:\program files\mozilla firefox.
Chrome is not even in the add-remove programs list. Not in the start menu, not on the desktop.
What does it mean, is it preinstalled.
Searching the registry for 'No chrome offer until' leads me to find that....
There is a key hkey_local_machine\software\google under which this subkey is.
Thats hkey_local_machine\software\google\no chrome offer until
In the list of 'name-type-data' pairs on the right hand panel for this
'no chrome offer until' .....
NAME . . . . . . . . . TYPE . . . . . . . . . . . . DATA
(Default) . . . . . . . REG_SZ . . . . . . . . . . (value not set)
ALWIL Software . . .REG_DWORD . . . . . . . 0x0132dbe3 (20110307)
How is it supposed to be related to alwil (alwil is for avast, and i no longer have avast on my system).
If you said no to the offer of Google Chrome when installing Avast,looks like the "hkey_local_machine\software\google\no chrome offer until" is created so you aren't offered Google Chrome again,from all I've gathered.
As for the other one,a google search shows:
http://www.google.ca/search?source=i...earch&aq=f&oq=
I do keep getting a google chrome offer at the top right of my google.com page when i am in internetexplorer. It goes off sometimes, like it went off when i had run combofix first time, came back after i had run second time.Quote:
Originally Posted by Zenobia
Seems like a switch. I wonder if that chrome ad has anything to do with this.
Surprisingly,the two combofix runs were after avast was uninstalled, so i wonder if avast could have played a role in switching the switch off or back on.
Besides these i also want to know about the following three keys in my registry under HKEY_LOCAL_MACHINE\software\
- c075t5y
- gemplus (search shows this is a crytopraphy software to read smart cards)
- lameme (search shows this is a dialer as in http://www.wilderssecurity.com/showthread.php?t=8533)
The Google Chrome offer is only when installing Avast,and isn't offered through Internet Explorer,that I know of.
I found a few pages that say the lameme registry key is created by InstallShield,though these are all older posts:
http://community.flexerasoftware.com...hreadid=102855
When looking for any info about the Schlumberger Smart Cards and Terminals,I found pages that said they were changing their name to Axalto.
http://www.smartcardalliance.org/art...ghts-as-axalto
When searching for Gemplus,I saw that Gemplus merged with Axalto to create Gemalto.Perhaps the Schlumberger Smart Cards and Terminals entry is connected to the Gemplus entry on your computer.
http://www.gemplus.com/
As for the HKEY_LOCAL_MACHINE\software\c075t5y registry key,I couldn't find anything about it anywhere,and it looks random.
Was your computer previously infected?
It could be a leftover registry key from a previous infection.
Or are you having any problems that seem like they could be malware related right now?
Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\C07ft5Y is related to the Macrovision Secdrv.sys driver which shipped with Windows XP as well as other Windows operating systems.
The following paragraph is from this MS Security Bulletin link:
Microsoft Security Bulletin MS07-067 – Important
Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege (944653)
What is secdrv.sys?
The driver, secdrv.sys, is used by games which use Macrovision SafeDisc. The driver validates the authenticity of games that are protected with SafeDisc and prohibits unauthorized copies of such games to play on Windows. The secdrv.sys is included with Microsoft Windows XP, Windows Server 2003, and Windows Vista to increase compatibility of the games on Windows. Without the driver, games with SafeDisc protection would be unable to play on Windows. SafeDisc remains inactive until invoked by a game for authorization to play on Windows.
As with the other two keys, this is commonly found on Windows XP and like anything in the registry, should not be modified unless you 100% understand what the effect will be. As always, the recommendation is to never touch anything in the registry, since doing so can result in a crippled operating system.
Bitman
Thanks,bitman. :)