FreeAccessBar Spyware Profile
Title: FreeAccessBar
Also Known as: Adware.Win32.FreeAccessBar
Severity scale:
FreeAccessBar is a spyware program created by the company called Free Access Toolbar or Petro-Line Ltd. It was first discovered on March 26 of 2006. It has to be manually downloaded on your computer from the vendors’ website at http://freeaccessbar.com.
It pretends to be a browser enhancing toolbar and pop-up blocker. The blocking of pop-ups is an ironic feature, since it delivers pop-up ads. The toolbar itself is virtually worthless.
The pop-ups that it delivers are contextually based on your browsing. FreeAccessBar monitors your browsing habits and uploads them to a remote server in order to do this. While it is supposedly monitored by its vendor, reports have been made of abuses of this program, such as using it to download more malware.
If you have it, get rid of it with SpyZooka.
Also Known As:
Adware.Win32.FreeAccessBar, FreeAccess Toolbar, Adware.FreeAccessBar
Associated Files:
%ProgramFiles%\FreeAccessBar\FreeAccessBar\FreeAccessBar.dll, %ProgramFiles%\FreeAccessBar\FreeAccessBar\Uninstall.exe, C:\fab.log, %ProgramFiles%\FreeAccessBar\FreeAccessBar\keys1, FreeAccessBarInstaller.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27685FBE-5745-4C09-8FB8-CD16269C58EE}\InprocServer32 “@” = “%ProgramFiles%\FreeAccessBar\FreeAccessBar\FreeAccessBar.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7}\InprocServer32 “@” = “%ProgramFiles%\FreeAccessBar\FreeAccessBar\FreeAccessBar.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\InprocServer32 “@” = “%ProgramFiles%\FreeAccessBar\FreeAccessBar\FreeAccessBar.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}\1.0\0\win32 “@” = “%ProgramFiles%\FreeAccessBar\FreeAccessBar\FreeAccessBar.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}\1.0\HELPDIR “@” = “%ProgramFiles%\FreeAccessBar\FreeAccessBar”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27685FBE-5745-4C09-8FB8-CD16269C58EE}\InprocServer32 “ThreadingModel” = “Apartment”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7}\InprocServer32 “ThreadingModel” = “Apartment”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\InprocServer32 “ThreadingModel” = “Apartment”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27685FBE-5745-4C09-8FB8-CD16269C58EE} “@” = “SearchPanel”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7}\VersionIndependentProgID “@” = “FreeAccessBar.FreeAccessBar”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7}\TypeLib “@” = “{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\TypeLib “@” = “{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\TypeLib “@” = “{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CFBD7FDA-60EF-41c6-A598-A0BF7842D996}\TypeLib “@” = “{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7}\ProgID “@” = “FreeAccessBar.FreeAccessBar.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.FreeAccessBar\CurVer “@” = “FreeAccessBar.FreeAccessBar.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5A202B62-4218-4978-99B3-C5562175A0D7} “@” = “FreeAccessBar”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\VersionIndependentProgID “@” = “FreeAccessBar.ActiveX”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F}\ProgID “@” = “FreeAccessBar.ActiveX.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.ActiveX\CurVer “@” = “FreeAccessBar.ActiveX.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CFBD7FDA-60EF-41c6-A598-A0BF7842D996}\TypeLib “Version” = “1.0″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CFBD7FDA-60EF-41c6-A598-A0BF7842D996}\ProxyStubClsid32 “@” = “{00020424-0000-0000-C000-000000000046}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CFBD7FDA-60EF-41c6-A598-A0BF7842D996}\ProxyStubClsid “@” = “{00020424-0000-0000-C000-000000000046}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79EE2FD0-4637-481e-B4EB-50FE9E79267F} “@” = “ActiveX”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CFBD7FDA-60EF-41c6-A598-A0BF7842D996} “@” = “ActiveX”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}\1.0\FLAGS “@” = “0″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{664AB1BA-BC40-4ecb-A9A1-60852EEDE4ED}\1.0 “@” = “FreeAccessBar 1.0 Type Library”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.ActiveX “@” = “ActiveX Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.ActiveX\CLSID “@” = “{79EE2FD0-4637-481e-B4EB-50FE9E79267F}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.ActiveX.1\CLSID “@” = “{79EE2FD0-4637-481e-B4EB-50FE9E79267F}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.FreeAccessBar\CLSID “@” = “{5A202B62-4218-4978-99B3-C5562175A0D7}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.FreeAccessBar.1\CLSID “@” = “{5A202B62-4218-4978-99B3-C5562175A0D7}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.FreeAccessBar “@” = “FreeAccessBar Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.FreeAccessBar.1 “@” = “FreeAccessBar Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeAccessBar.ActiveX.1 “@” = “FreeAccessBar Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
\{5A202B62-4218-4978-99B3-C5562175A0D7} “@” = “FreeAccessBar Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar “{5A202B62-4218-4978-99B3-C5562175A0D7}” = “”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeAccessBar “DisplayName” = “FreeAccessBar”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeAccessBar “UninstallString” = “”%ProgramFiles%\FreeAccessBar\FreeAccessBar\Uninstall.exe”"
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar
“ReportTime” = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “Date” = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “Life” = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “UninstallerPath” = “”%ProgramFiles%\FreeAccessBar\FreeAccessBar\Uninstall.exe”"
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “NewInstall” = 0×00000001
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “Key” = “ffffff”
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “CheckUpdate” = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “Install” = 0×00000001
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “UID” = = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “Link” = [RANDOM VALUE]
HKEY_CURRENT_USER\Software\FreeAccessBar\FreeAccessBar “LinkCount” = [RANDOM VALUE]“XXnameXX” = “XXvalueXX”
This virus incorporated itself into my computer out of the blue. I’m sure that I didn’t downloaded it. I was sick of the pop ups and somehow, my computer was full of viruses in one week. This was a real pain in the neck.