Limited Time!
Totally FREE Web Design!
Click here!

Parasite: TargetSaver

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

TargetSaver is a process run at Windows startup, which opens pop-ups. Controlled by TargetSaver Inc (targetsaver.com).

Variants

TargetSaver/Tsa: first version, uses filenames ts.exe, tsl.exe and tsm.exe, stored in the Common Files folder.

TargetSaver/Tsa2: revision using filenames ts2.exe, tsl2.exe, tsm2.exe and tsp2.exe, along with ‘lock’ files held open.

Also known as

The Tsa variant is detected as Uploader-R by McAfee anti-virus.

Distribution

Silently installed by the ISTbar and ILookup parasites.

What it does

Advertising

Yes. Opens pop-up advertising when targeted words appear in the page being viewed.

Privacy violation

None observed.

Security issues

Yes. Can download and execute signed code from its controlling servers, as an update feature.

Stability problems

None known.

Removal

Open the Control Panel’s Add/Remove Programs option. Select ‘TSA’ and click ‘Remove’. This may fail if the software has updated itself from the Tsa variant to Tsa2.

Manual Removal

Open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’) and select the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. On the right, right-click the entry ‘Tsa’ pointing to tsm.exe (Tsa variant) or ‘Tsa2’pointing to tsm2.exe (Tsa2 variant) and choose ‘Delete’.

Restart the computer and you should be able to delete the ‘tsa’ folder in the Common Files folder (inside Program Files).