Spyware?

  • Thread starter Thread starter B.W.
  • Start date Start date
-----Original Message-----
What is Addon2VB.dll

TIA

BW

www.pestpatrol.com/PestInfo/
.
Click to expand...



Overview
Summary: Uses the Internet to dynamically deliver content
to desktop software. Once the content is received, it can
be displayed at any time in the application. Content
activity information such as advertising impressions and
click through data is recorded and sent back to Conducent
for daily reporting. No installation disclosure. Displays
ads. Causes browser pop-ups. Tracks usage. Collects
personal info.Conducent does not provide users with an
uninstall feature. Their software provides real-time ad
targeting campaigns through the Timesink component
TSadbot.exe. Conducent has formed strategic partnerships
with most of the major Internet advertising networks. The
company is now out of business, but its product lives
on.
Alias: archive: Embedded EXE [Kaspersky]
Category: Spyware: Any product that employs a user's
Internet connection in the background without their
knowledge or explicit permission, and gathers/transmits
info on the user, their machine, or their behavior.

Similar Pests: Spyware
Origins
Group: Conducent Technologies, Inc.
By This Group: Timesink
Date of Origin: April, 1999
Distribution
Prevalence: Conducent TimeSink: 0.0% of all pest reports
(37 per 100,000 reports) More Info

Clot Factor: Conducent TimeSink: On average, 12 objects
detected in each machine
The "Clot Factor" is a measure of how much a pest "gums
up" a machine by adding registry entries, files, and
directories. As more objects are placed in a machine,
manual removal becomes more difficult and more error-
prone.

Countries Affected: In the past three months, we have
received reports of Conducent TimeSink in Australia,
Austria, Belgium, Brazil, Canada, Croatia, Denmark,
Finland, France, Germany, Greece, Hungary, Ireland,
Italy, Japan, Netherlands, Norway, Poland, Portugal,
Russian Federation, Saudi Arabia, South Korea, Spain,
Sweden, Switzerland, Taiwan, Thailand, Tunisia, Turkey,
United Kingdom, United States, Venezuela.
Growth: Conducent TimeSink: Increased 870.6% over the
last 90 days

Operation
General: When installed, creates four registry keys


HKEY_USERS\.default\software\TimeSink, Inc.
HKEY_LOCAL_MACHINE\software\TimeSink, Inc.
HKEY_CURRENT_USER\software\TimeSink, Inc.
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversi
on\run\ "C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE

The following files are installed:

C:\WINDOWS\tsad.dll TSAD.DLL has the internal product
name of 'Conducent AdGateway', the internal name
of 'tsad', and internal company name of 'Conducent
Technologies, Inc.' Version evaluated: 4.1.0.1. Size:
210,994 bytes.
C:\WINDOWS\SYSTEM\VcpDLL.dll VCPDLL.DLL has the internal
product name of 'Conducent Technologies, Inc. VcpDLL',
the internal name of 'VcpDLL', and internal company name
of 'Conducent Technologies, Inc.' Version evaluated:
4.1.0.1. Size: 229,376 bytes.
C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE TSAdbot
has no user interface. Upon invocation, it immediately
tries to make an internet connection to 209.67.3.166:53.
If denied the connection, it exits. Tsadbot.exe has the
internal product name of 'Conducent AdGateway', the
internal name of 'TSAdBot', and internal company name
of 'Conducent Technologies, Inc.' Version evaluated:
4.1.0.1. Size: 95,744 bytes.
C:\Program Files\[Companion program home]
\TSUninstaller.exe Running the TSUninstaller.exe does not
uninstall TimeSink. Instead, it delivers the error 'No
AppName specified'.
Multiple connections to Conducent ad-servers including
adsdl.conducent.com, redirects.conducent.com (various
ports). Proxy service prevents NETSTAT and similar
network tools from disclosing actual addresses connected
to (they appear in the form of ADS*:portnumber)

Advertising: Displays a stream of flashing ad banners
when certain software is installed, including monstrous
fullscreen (640x480) ads!
Storage Required: at least 15061KB
ScreenShot:
.../Images/ConducentImageCarousalAlert.gif Risks
Privacy Issues: Yes. May snoop browser history and cache
files.
Risk: Invoking a product such as Banner Crafter will
invoke the TSAdBot without alerting the user.
Uninstalling a Conducent companion product, such as
BannerCrafter, using its own uninstall procedure, does
not uninstall any of the TimeSink files or remove any of
the TimeSink registry entries. TimeSink will continue to
be invoked with each boot.
If installation of software embedded with Conducent
Timesink is terminated by not agreeing with the EULA,
Timesink will install itself without the software host.
"...if the AdBot is thwarted in its attempts to connect
to Conducent by a firewall or other controls [...] It
starts to attempt to connect continually, about 10
times/second causing a huge load on local network
facilities. If it can't connect even then, it tries to
connect using Telnet and other ports with the background
AdBot retrying the HTTP connects after several hours."
(Ref: Debate Mailing List Archives, Univ of Mannheim,
Computing Center)
TSADBOT is installed as a Windows Service when certain
software is installed, most notably new versions of
PKzip.

Several sources actually list this program
under "Viruses", and it's not difficult to see why. It is
secretly loaded onto your system when you install
completely unrelated software (or even if you don't!),
makes clandestine network connections behind the user's
back, persists even after the software it came with has
been uninstalled, and is very difficult to remove.

Once installed, the TSADBOT program is loaded every time
Windows starts and runs invisibly in the background until
the computer is shut down. It connects to the Internet
and downloads ads, whether the advertising-supported
application is running or not, and implements an
unauthorized proxy server on the user's system which
disguises the adware's network connections. AdGateway
(demographic/behavioral?) "profiles" are stored in
encrypted files on the user's system, and may be
transmitted to Conducent by the TSADBOT software. The
TSADBOT software accesses the user's browser cache and
History (list of sites you've visited) for purposes
unknown, and may use this information in the creation of
behavioral profiles or transmit this information to
Conducent.

Detection and Removal
Automatic Removal: PestPatrol detects this.

PestPatrol removes this.



Manual Removal: Delete these files:
tsadbot.exe (C:\Program Files\TimeSink\AdGateway)
tsad.dll (C:\Winnt or C:\Windows)
vcpdll.dll (C:\Winnt or C:\Windows)
FlexActv.dll (C:\Winnt or C:\Windows)
Addon2VB.dll (C:\Winnt\System or C:\Windows\System) (if
found)

If you get an error message, and any of these files won't
delete, they are running. If not running, go on to step
4. If any are running, go to step 3.
If any of these files are running, try stopping it with a
CTRL-ALT-DEL to bring up the End Task dialogue. You may
or may not see TSADBOT on the list. (Early versions will
be listed, but recent versions are stealth, and will not
be listed, even when running.) Choose End Task for
TSADBOT if you can. Repeat step 1 to determine if
TSADBOT.EXE is now running. If running, go to step 3. If
not running, go to step 4.
Disable TSADBOT's autostart capability, then reboot. To
disable autostart, use Start | Run | MSCONFIG, uncheck
the Timesink agent on the startup tab, then reboot. Go to
step 4.
If any of these files will NOT delete (access denied / in
use / sharing violation), you will have to restart in MS-
DOS mode (press F8 during boot) to delete them using the
appropriate DOS commands. If running, TSADBOT may hold a
lock on its files preventing them from being deleted.

Stop Running Processes:

Kill these running processes with Task Manager:

arfree11.exe
bc.exe
ic2free.exe
patriotsetup.exe
setupquizzer.exe
ssspider.exe
tsadbot.exe
tsuninstaller.exe
wcamvcr.exe


Unregister DLLs:

Unregister these DLLs with Regsvr32, then reboot:

systemroot+\system\vcpdll.dlltsad.dll
vcpdll.dll


Remove Files:

Remove these files (if present) with Windows Explorer:

systemroot+\system\vcpdll.dllarfree11.exe
bc.exe
ic2free.exe
patriotsetup.exe
setupquizzer.exe
ssspider.exe
tsad.dll
tsadbot.exe
tsuninstaller.exe
vcpdll.dll
wcamvcr.exe
 
Back
Top