Limited Time!
Totally FREE Web Design!
Click here!

Parasite: DialerMaker

This record last updated Tue Sep 20 2005 00:34:15

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

DialerMaker is an ActiveX downloader control used to load premium-rate dialler software, signed by ‘Globalised Communications Limited’.

Variants

DialerMaker/Cax installs cax.dll into the System32 folder.

DialerMaker/SC installs sc.dll.

Also known as

EP-Service, after the company name in the control.

Distribution

Drive-by download on web pages, often porn-related pop-up ads and blind links.

What it does

Advertising

No.

Privacy violation

No.

Security issues

Yes, severe. When the DialerMaker ActiveX control is installed, any web page can use it to download and execute arbitrary code from any server.

Stability problems

No.

Removal

Open the Downloaded Program Files folder and delete the entry (‘CAX Object’). This is just to clear up; it does not actually remove the software.

Open a Command Prompt window (click Start, open the Programs menu and the Accessories submenu; called ‘DOS Prompt’ on Windows 95/98/Me). Enter the following commands, for the Cax variant:

cd "%WinDir%\System"
regsvr32 /u cax.dll

Or, for the SC variant:

cd "%WinDir%\System"
regsvr32 /u sc.dll

Reset the machine and you should be able to delete the file ‘cax.dll’ (Cax variant) or ‘sc.dll’ (SC variant) from the System32 folder (inside the Windows folder; called just ‘System’ on Windows 95/98/Me.