Sophos

Safe Address bar

Aliases
  • AdWare.Win32.Barogo.af
  • Adware:Win32/AdSearch
Category
Type
What to do
  • If you've received an alert for a blocked PUA or adware and decide that the application is not suitable for your workplace, then follow the instructions for removing PUAs.

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
  • Monitors browser activity
Included in our products from June 2008 (4.30)
Protection available since 24 April 2008 17:54:49 (GMT)
Detected by Sophos Anti-Virus for Windows, version 7, and PureMessage for Microsoft Exchange.

More Information

"Safe Address bar" is an adware / spyware plugin for Microsoft Internet Explorer.

When "Safe Address bar" is installed the following folder and files are created:

<Program Files>\Windows Safe Address Bar
<Program Files>\Windows Safe Address Bar\edits.dat
<Program Files>\Windows Safe Address Bar\keywords.dat
<Program Files>\Windows Safe Address Bar\SafeAddrbar.dll
<Program Files>\Windows Safe Address Bar\uninstall.exe
<Program Files>\Windows Safe Address Bar\update.dat
<Program Files>\Windows Safe Address Bar\Updater.exe
<Program Files>\Windows Safe Address Bar\tmp\

The file SafeAddrbar.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52935D1F-EB42-4ed1-810B-37693A834B48}
HKCR\TypeLib\{D25E648A-A961-459F-ABE4-125E2B67F979}
HKCR\Interface\{EBEFC9E2-C46F-4F10-9554-8372D155B0E4}
HKCR\CLSID\{52935D1F-EB42-4ed1-810B-37693A834B48}
HKCR\safeaddrbar.safeaddrbarObj
HKCR\safeaddrbar.safeaddrbarObj.1

Registry entries are created under:

HKCU\Software\Windows Safe Address Bar
HKLM\SOFTWARE\Windows Safe Address Bar
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safe Address Bar

"Safe Address bar" provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Windows IE Safe Address Driver".

RSS|Atom
Get reports about the latest adware and potentially unwanted applications (PUAs) delivered to your computer