Parasite: DialerActiveX

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

DialerActiveX is an ActiveX control placed on web sites to run premium-rate diallers.

Variants

DialerActiveX/GoInDirect is signed by goindirect.com in October 2002, and has been distributed early in 2003. It is an installer control which can download and execute other diallers.

DialerActiveX/AllInOne is signed by ‘All-In-One Telcom’ and has been distributed since Summer 2001. It contains a built-in dialler, and may sometimes deinstall itself after running the dialler.

Distribution

Drive-by download on web pages, sometimes advertised by junk e-mail or pop-ups.

What it does

Advertising

No.

Privacy violation

No.

Security issues

With the GoInDirect variant installed, any web page can direct it to download and execute a dialler.

Stability problems

No.

Removal

There is no uninstall option. Ad-Aware 6 reflist 0R125 and later can remove the GoInDirect variant.

Manual removal

Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands, for the GoInDirect variant:

cd "%WinDir%\System"
regsvr32 /u dialer_activex.ocx

Then open the System folder (inside the Windows folder, named ‘System32’ under Windows XP/2000/NT or just ‘System’ under Windows Me/98/95), and delete the file ‘dialer_activex.ocx’.

For the AllInOne variant, use the commands:

cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\dialer_activex.ocx"
del "..\Downloaded Program Files\dialer_activex.*"

Finally remove any dialler installed by either variant. There are likely to be shortcuts on the desktop, Start menu and Programs menu to delete, and possible a folder ‘C:\Program Files\dialer’.

* Parasite information and detection script by Andrew Clover - www.doxdesk.com, used with permission.

For more information about Scumware, Spyware and Parasites, their sources and their cure, visit our About Parasites page and related Tech Links.

Visit our new services portal at Allen One for a completely new parasite database format, comming November 2005!