Results 1 to 9 of 9

Thread: What are these programs for, they are installed in my programs i found...??

  1. #1
    Guest
    Join Date
    Sep 2010
    Posts
    158

    Default What are these programs for, they are installed in my programs i found...??

    One is
    'No Chrome Offer Until'. This one's author is written google.

    Another one is
    'Smart Cards and Terminals'. This one author written Schlumberger.



    (I have another varied name of Spybot - Search & Destroy too. But, i will ask about it in the Spybot - Search & Destroy section.)

  2. #2
    Guest
    Join Date
    Sep 2010
    Posts
    158

    Default

    The program is this much name.... 'No Chrome Offer Until'. Can it be chrome? I never installed google chrome, but i have a chrome folder in c:\program files\mozilla firefox.

    Chrome is not even in the add-remove programs list. Not in the start menu, not on the desktop.

    What does it mean, is it preinstalled.

  3. #3
    Guest
    Join Date
    Sep 2010
    Posts
    158

    Default

    Searching the registry for 'No chrome offer until' leads me to find that....

    There is a key hkey_local_machine\software\google under which this subkey is.

    Thats hkey_local_machine\software\google\no chrome offer until


    In the list of 'name-type-data' pairs on the right hand panel for this
    'no chrome offer until' .....

    NAME . . . . . . . . . TYPE . . . . . . . . . . . . DATA

    (Default) . . . . . . . REG_SZ . . . . . . . . . . (value not set)
    ALWIL Software . . .REG_DWORD . . . . . . . 0x0132dbe3 (20110307)


    How is it supposed to be related to alwil (alwil is for avast, and i no longer have avast on my system).
    Last edited by venus_n; 2010-11-07 at 19:11.

  4. #4
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    If you said no to the offer of Google Chrome when installing Avast,looks like the "hkey_local_machine\software\google\no chrome offer until" is created so you aren't offered Google Chrome again,from all I've gathered.

    As for the other one,a google search shows:
    http://www.google.ca/search?source=i...earch&aq=f&oq=

  5. #5
    Guest
    Join Date
    Sep 2010
    Posts
    158

    Default

    Quote Originally Posted by Zenobia View Post
    If you said no to the offer of Google Chrome when installing Avast,looks like the "hkey_local_machine\software\google\no chrome offer until" is created so you aren't offered Google Chrome again,from all I've gathered.
    I do keep getting a google chrome offer at the top right of my google.com page when i am in internetexplorer. It goes off sometimes, like it went off when i had run combofix first time, came back after i had run second time.
    Seems like a switch. I wonder if that chrome ad has anything to do with this.

    Surprisingly,the two combofix runs were after avast was uninstalled, so i wonder if avast could have played a role in switching the switch off or back on.
    Last edited by venus_n; 2010-11-08 at 05:00.

  6. #6
    Guest
    Join Date
    Sep 2010
    Posts
    158

    Default

    Besides these i also want to know about the following three keys in my registry under HKEY_LOCAL_MACHINE\software\


  7. #7
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    The Google Chrome offer is only when installing Avast,and isn't offered through Internet Explorer,that I know of.

    I found a few pages that say the lameme registry key is created by InstallShield,though these are all older posts:
    http://community.flexerasoftware.com...hreadid=102855

    When looking for any info about the Schlumberger Smart Cards and Terminals,I found pages that said they were changing their name to Axalto.
    http://www.smartcardalliance.org/art...ghts-as-axalto
    When searching for Gemplus,I saw that Gemplus merged with Axalto to create Gemalto.Perhaps the Schlumberger Smart Cards and Terminals entry is connected to the Gemplus entry on your computer.
    http://www.gemplus.com/

    As for the HKEY_LOCAL_MACHINE\software\c075t5y registry key,I couldn't find anything about it anywhere,and it looks random.
    Was your computer previously infected?
    It could be a leftover registry key from a previous infection.
    Or are you having any problems that seem like they could be malware related right now?

  8. #8
    Esteemed Member
    Join Date
    Oct 2005
    Posts
    554

    Default

    Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\C07ft5Y is related to the Macrovision Secdrv.sys driver which shipped with Windows XP as well as other Windows operating systems.

    The following paragraph is from this MS Security Bulletin link:
    Microsoft Security Bulletin MS07-067 – Important
    Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege (944653)


    What is secdrv.sys?
    The driver, secdrv.sys, is used by games which use Macrovision SafeDisc. The driver validates the authenticity of games that are protected with SafeDisc and prohibits unauthorized copies of such games to play on Windows. The secdrv.sys is included with Microsoft Windows XP, Windows Server 2003, and Windows Vista to increase compatibility of the games on Windows. Without the driver, games with SafeDisc protection would be unable to play on Windows. SafeDisc remains inactive until invoked by a game for authorization to play on Windows.


    As with the other two keys, this is commonly found on Windows XP and like anything in the registry, should not be modified unless you 100% understand what the effect will be. As always, the recommendation is to never touch anything in the registry, since doing so can result in a crippled operating system.

    Bitman

  9. #9
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    Thanks,bitman.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •