Conducent TimeSink

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Recommendations ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 Uses the Internet to dynamically deliver content to desktop software. Once the content is received, it can be displayed at any time in the application. Content activity information such as advertising impressions and click through data is recorded and sent back to Conducent for daily reporting. No installation disclosure. Displays ads. Causes browser pop-ups. Tracks usage. Collects personal info.Conducent does not provide users with an uninstall feature. Their software provides real-time ad targeting campaigns through the Timesink component TSadbot.exe. Conducent has formed strategic partnerships with most of the major Internet advertising networks. The company is now out of business, but its product lives on.

Alias:

 archive: Embedded EXE

Category:

Spyware: Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior. Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.) Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware.

Similar Pests:

 Spyware

Origins

Group:

 Conducent Technologies, Inc.

Vendor:

 Conducent Technologies, Inc. (now out of business)

By This Group:

 Timesink ·

Date of Origin:

 April, 1999

Distribution

Prevalence:
  • Conducent TimeSink: 0.0%
    • More Info

    Clot Factor:
  • Conducent TimeSink: 20

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • Conducent TimeSink: Insufficient data to report growth
    		•

    Operation

    General:

    When installed, creates four registry keys

    • HKEY_USERS\.default\software\TimeSink, Inc.
    • HKEY_LOCAL_MACHINE\software\TimeSink, Inc.
    • HKEY_CURRENT_USER\software\TimeSink, Inc.
    • HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ "C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE

    The following files are installed:

    • C:\WINDOWS\tsad.dll TSAD.DLL has the internal product name of 'Conducent AdGateway', the internal name of 'tsad', and internal company name of 'Conducent Technologies, Inc.' Version evaluated: 4.1.0.1. Size: 210,994 bytes.
    • C:\WINDOWS\SYSTEM\VcpDLL.dll VCPDLL.DLL has the internal product name of 'Conducent Technologies, Inc. VcpDLL', the internal name of 'VcpDLL', and internal company name of 'Conducent Technologies, Inc.' Version evaluated: 4.1.0.1. Size: 229,376 bytes.
    • C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE TSAdbot has no user interface. Upon invocation, it immediately tries to make an internet connection to 209.67.3.166:53. If denied the connection, it exits. Tsadbot.exe has the internal product name of 'Conducent AdGateway', the internal name of 'TSAdBot', and internal company name of 'Conducent Technologies, Inc.' Version evaluated: 4.1.0.1. Size: 95,744 bytes.
    • C:\Program Files\[Companion program home]\TSUninstaller.exe Running the TSUninstaller.exe does not uninstall TimeSink. Instead, it delivers the error 'No AppName specified'.

    Multiple connections to Conducent ad-servers including adsdl.conducent.com, redirects.conducent.com (various ports). Proxy service prevents NETSTAT and similar network tools from disclosing actual addresses connected to (they appear in the form of ADS*:portnumber)

    Advertising:

    		 Displays a stream of flashing ad banners when certain software is installed, including monstrous fullscreen (640x480) ads!

    Storage Required:
  • Conducent TimeSink: at least 609 KB
    		•

    ScreenShot:

    Risks

    Privacy Issues:

    Yes. May snoop browser history and cache files.

    Risk:

    TSADBOT is installed as a Windows Service when certain software is installed, most notably new versions of PKzip.

    Several sources actually list this program under "Viruses", and it's not difficult to see why. It is secretly loaded onto your system when you install completely unrelated software (or even if you don't!), makes clandestine network connections behind the user's back, persists even after the software it came with has been uninstalled, and is very difficult to remove.

    Once installed, the TSADBOT program is loaded every time Windows starts and runs invisibly in the background until the computer is shut down. It connects to the Internet and downloads ads, whether the advertising-supported application is running or not, and implements an unauthorized proxy server on the user's system which disguises the adware's network connections. AdGateway (demographic/behavioral?) "profiles" are stored in encrypted files on the user's system, and may be transmitted to Conducent by the TSADBOT software. The TSADBOT software accesses the user's browser cache and History (list of sites you've visited) for purposes unknown, and may use this information in the creation of behavioral profiles or transmit this information to Conducent.

    Recommendations

    Prevention:

    Conducent TimeSink: 0.0% of all pest reports (38 per 100,000 reports)

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.



    Manual Removal:

    1. Delete these files:

      2. tsadbot.exe (C:\Program Files\TimeSink\AdGateway)
      tsad.dll (C:\Winnt or C:\Windows)
      vcpdll.dll (C:\Winnt or C:\Windows)
      FlexActv.dll (C:\Winnt or C:\Windows)
      Addon2VB.dll (C:\Winnt\System or C:\Windows\System) (if found)

    2. If you get an error message, and any of these files won't delete, they are running. If not running, go on to step 4. If any are running, go to step 3.
    3. If any of these files are running, try stopping it with a CTRL-ALT-DEL to bring up the End Task dialogue. You may or may not see TSADBOT on the list. (Early versions will be listed, but recent versions are stealth, and will not be listed, even when running.) Choose End Task for TSADBOT if you can. Repeat step 1 to determine if TSADBOT.EXE is now running. If running, go to step 3. If not running, go to step 4.
    4. Disable TSADBOT's autostart capability, then reboot. To disable autostart, use Start | Run | MSCONFIG, uncheck the Timesink agent on the startup tab, then reboot. Go to step 4.
    5. If any of these files will NOT delete (access denied / in use / sharing violation), you will have to restart in MS-DOS mode (press F8 during boot) to delete them using the appropriate DOS commands. If running, TSADBOT may hold a lock on its files preventing them from being deleted.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:

  • Conducent (Timesink)
  • Advertising Spyware: TSADBOT
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!

    • Research By:

  • PestPatrol's Pest Research Center

    • Last Revised:

    April 15, 2005