Author Topic: Any idea what this is?  (Read 441 times)

0 Members and 1 Guest are viewing this topic.

Offline FD

  • Bronze Member
  • Posts: 249
Any idea what this is?
« on: May 21, 2012, 08:43:52 PM »
I ran CCleaner and for kicks I ran the registry cleaner, just to see what is going on there.  No I didn't delete any entries I know better that that. However this entry has me scratching my head.  It was labeled as a unused file extension, this was copied directly from the registry HKEY_CLASSES_ROOT\//×¢²áÓÒ¼üÏÔʾµÄÎļþ, any clue what it is?  This was in windows 7.

Thanks,
FD



Online Hoov

  • Malware Removal Mentors
  • Global Moderator
  • Diamond Member
  • Posts: 22649
  • Unwilling part owner of Gov't. Motors and Chrysler
    • Hoov's Personal Site
Re: Any idea what this is?
« Reply #1 on: May 21, 2012, 09:06:44 PM »
Have you used Advanced System Care at any time? I have found 2 references to the exact same string. The first is a reply to another post. Here is the reply, http://www.gratissoftwaresite.nl/comment/reply/87/625 I was going to give the link to the translated version, but I am being blocked.

The translated version changes the string, so it might be a fluke, or it could just be the translator did not do it correctly.

The other post shows up in google, but I cannot find the string anywhere in the post.

If I were to run across that in my own registry, I would disconnect from the internet, scan my computer and do a chkdsk and any other scan I could think of. I would also check out my event viewer logs to see if something showed up there. I would also go thru my C: drive and make sure nothing got installed behind my back. Then I would run Ccleaner and do a thorough cleaning, then run defrag. Then for about the next week I would watch my system closely while I was online. But then I am paranoid.

One other thing, I stay away from registry cleaners unless I am looking for something specific. I also recommend that others do the same. To many registries get corrupted because someone ran a registry cleaner without knowing about the registry. For anyone reading this, stay away from registry cleaners.

Consumer Security

If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

Offline 1972vet

  • Microsoft® MVP
  • Malware Removal Staff
  • Diamond Member
  • Posts: 8290
  • Patience is bitter indeed, but its fruit is sweet.
Re: Any idea what this is?
« Reply #2 on: May 22, 2012, 04:50:40 AM »
Hoov has posted good advice and I would follow it to the letter if I were a novice user...as all of us here are particularly sensitive to rendering instructions for such users so as to even err on the side of caution. It's a good practice to do no harm.

However, in this instance, I can say that those are HTML ASCII characters. You find them on occasion, due to translating issues as is sometimes encountered with certain languages...computer code languages such as VB (visual basic). I know adobe for one is good for this type of thing. However, these type entries, although alarming at first, can be innocuous. There are some legitimate applications that will produce this behavior. I had an old printer that would show up in certain scan logs showing similar hidden entries in the registry. Being hidden as even more alarming but...it too was legitimate.

In your case, those characters translate to a GUID that relates to Avira. Why CCleaner sees it as unnecessary is a bit of a mystery but then, I haven't seen a scan log entirely, nor have I questioned you about programs installed and such. So...it could be that you either have uninstalled Avira or had it disabled at the time when CCleaner found those entries. On the other hand, it could very well be a needed entry that CCleaner should  ignore. With this information I've provided, you can see then that security tools can also produce such entries.

In this case, I would leave it be since it is a harmless entry although possibly unnecessary. I would leave it alone, let's put it that way. It would be my guess that if Avira is still installed, you could use CCleaner to remove that entry but it would more than likely return...instantly. And I say that only because I am familiar with the excellent method by which the authors of Avira have written their program(s). Other, less comparable, tools could be crippled if you used CCleaner to remove such an entry.

Just one more good example why novice folks should stay far away from the registry cleaning software programs unless you know what the entries represent that are produced during an alleged "cleaning" scan of the registry. It's my learned opinion, and shared with my colleagues, that the Windows registry has no need of cleaning...or defragmenting as is another term sometimes used to describe what these tools do.

There are plenty of security tools that remove registry entries which relate to malicious code. This type of "cleaning" is indeed necessary and enough since it's automated so the user has no need of messing about in the registry. 
Disabled Veteran
U.S.C.G. 1972 - 1978
Membership: U.N.I.T.E., A.S.A.P.

2009-12

Performance and Maintenance for Windows XP, Windows Vista and Windows Seven

Offline FD

  • Bronze Member
  • Posts: 249
Re: Any idea what this is?
« Reply #3 on: May 22, 2012, 05:13:29 AM »
Thanks for the replies.  Hoov-I had Advanced System Care but I'm positive it is no longer on the system, I did a format of the hard drive and a clean install of windows 7 on this machine, and did not install ASC.  Having said that I do have 3 programs from IObit the makers of Advanced System Care on my machine, I have their Smart Defrag, Malware remover, and Uninstaller on my machine. I never had Aviria. If there is a virus or Malware on this machine I give up! LOL I haven't been online with it enough to get a virus, all I've done was check email with it. Any programs I installed from the internet were installed via a flash drive, downloaded scanned, installed and used on, another machine, and they are 100% clean.  I never used or installed Avira. 

Thanks,
FD

Offline FD

  • Bronze Member
  • Posts: 249
Re: Any idea what this is?
« Reply #4 on: May 22, 2012, 05:31:49 AM »
One thing I forgot to mention was IObit did sneak in their Uninstaller program with their Disk Defrag Program.  I've used it on other machines so I left it alone.

FD

Offline 1972vet

  • Microsoft® MVP
  • Malware Removal Staff
  • Diamond Member
  • Posts: 8290
  • Patience is bitter indeed, but its fruit is sweet.
Re: Any idea what this is?
« Reply #5 on: May 22, 2012, 08:31:20 AM »
While I0bit is installed (anything form I0bit), nothing would surprise me. As they are known for stealing code from other security utilities, your registry reference to Avira may have come from your I0bit installation. I would uninstall whatever it is you have from I0bit and avoid it.

As to your Avira globally unique identifier reference, it's ASCII character's translate to temp file(s) found who's hash sum is:
MD5: 25daad3d9e60b45043a70c4ab7d3b1c6
...which has been scanned at VirScan. It's multi-engine scanners find nothing ominous about it.
Disabled Veteran
U.S.C.G. 1972 - 1978
Membership: U.N.I.T.E., A.S.A.P.

2009-12

Performance and Maintenance for Windows XP, Windows Vista and Windows Seven

Offline FD

  • Bronze Member
  • Posts: 249
Re: Any idea what this is?
« Reply #6 on: May 22, 2012, 08:54:39 AM »
Thanks for the info.  The IObit defragger I thought was pretty good, as well as their Malware finder which found something on a buddies machine that Super Anti-spyware, and Malwarebytes both missed.  I wish I had the name for the file.  I appreciate the help, I learn best by doing.

Offline 1972vet

  • Microsoft® MVP
  • Malware Removal Staff
  • Diamond Member
  • Posts: 8290
  • Patience is bitter indeed, but its fruit is sweet.
Re: Any idea what this is?
« Reply #7 on: May 22, 2012, 09:47:36 AM »
You might think it's good but it's actually not the I0bit scan engine finding something that others missed...it's all the anti-malware signature databases combined from which I0bit pilfers.

You might also think it's ok that I0bit has been found to be something less than above board, I don't know but, we don't recommend it here and I would believe all of us in the malware fighting community would agree there are much better scanners...even free versions of other scanners that are much more acceptable than I0bit's collage of pilfered code. You can, if you wish, read more about that Here.

I would prefer that users find some reputable vendor who is updating the product they advertise...and not from having stolen database signatures from other vendors. Think about it...how reliable can that be?

Bottom line is, we don't use it and we don't recommend using it...in fact, I believe all of us recommend removing it in favor of almost anything else. Geez, one may as well install one of the rogue anti-virus/anti-spyware scanners. Hey...a rogue is a rogue by any other name lol
Disabled Veteran
U.S.C.G. 1972 - 1978
Membership: U.N.I.T.E., A.S.A.P.

2009-12

Performance and Maintenance for Windows XP, Windows Vista and Windows Seven

Offline FD

  • Bronze Member
  • Posts: 249
Re: Any idea what this is?
« Reply #8 on: May 22, 2012, 02:55:33 PM »
Good to know.