Content

Adware-Simbar

Type
Program
SubType
Adware
Discovery Date
01/18/2005
Minimum DAT
4422 (01/26/2005)
Updated DAT
4587 (09/21/2005)
Minimum Engine
5.1.00
Description Added
01/24/2005
Description Modified
01/24/2005 5:01 AM (PT)

Tab Navigation

Characteristics

This is not a virus or trojan. It is a direct-marketing adware application. This application generates extra pop-up ads while using Internet Explorer.

This kind of application generally comes bundled with another program, which usually discloses the fact that it is ad-supported.  Users agree to have the Adware installed in the license agreement, although they may not realise at first that this file was packaged with the product they installed.

Installation

The following toolbar is installed in the Internet Explorer toolbars:

Upon execution, the application installs itself into the oringal installed directory.

The following Registry key(s) is/are added to hook system startup:

HKEY_CLASSES_ROOT\SimpleTbar.StockBar "(Default)" = "The Simple Toolbar Search"

HKEY_CLASSES_ROOT\SimpleTbar.StockBar\CLSID "(Default)" = "A6790AA5-C6C7-4BCF-A46D-0FDAC4EA99EB"

HKEY_CLASSES_ROOT\SimpleTbar.StockBar\CurVer "(Default)" = "The Simple Toolbar Search"

HKEY_CLASSES_ROOT\SimpleTbar.StockBar.1 "(Default)" = "The Simple Toolbar Search"

HKEY_CLASSES_ROOT\SimpleTbar.StockBar.1\CLSID "(Default)" = "A6790AA5-C6C7-4BCF-A46D-0FDAC4EA99EB"

HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}\1.0 "(Default)" = "SimpleTbar 1.0 Type Library"

HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}\1.0\0\win32 "(Default)" =

HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}\1.0\FLAGS "(Default)" = "0"

HKEY_CLASSES_ROOT\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}\1.0\HELPDIR "(Default)" =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} "(Default)" = "The Simple Toolbar Search"

Users who would like to check for the presence of potentially unwanted programs on their system should run the command line scanner with the /PROGRAM switch.
Please note that VirusScan 7, and higher, has an option that enables users to detect this kind of program automatically (see below).

Aliases

Aliases

    N/A