New Dialer: ConnectSwitch

Hello,

I found a nasty dialer ConnectSwitch at this popup 64.237.52.181/2003/Fresh_MP3s.htm.

Its a active-X control that install dialersoftware on the computer.
Warning: it opens a endless chain of popups when u refuse the installation

I have installed it on my testcomputer for this kind of purpose.

It don't install a CLSID key but this: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5CBF8C22-E9A6-11D7-90FE-000AE4012DB4}

I made the custom key in SpywareBlaster and it works just fine

(Sorry about my poor english)

Greetz

alphaZer0

 

Hi alphaZer0,

Good find. Looking at the code on that page, it's this one: http://securityresponse.symantec.com/avcenter/venc/data/dialer.lohan.html

So the CLSID of the main component is already in SpywareBlaster:
{8B22270A-71D9-4AB9-B11A-2EA1E5292F42} (under MSConnect)

Regards,

Pieter

 

H Pieter,

Sorry, but its not the same.
I have tested it over again without my selfmade protection and i get still this activex.
With protection it works.

Greetz

AlphaZer0

 

Hi alphaZer0,

I'm not arguing about the ActiveX, that is a new one. But the dialer itself should not work with SpywareBlaster's protection.

I'll PM you about the site where I found it thanks to your post.

Regards,

Pieter

 

Hi Pieter,

In the link You give i read:

4° Adds the subkey:

{8B22270A-71D9-4AB9-B11A-2EA1E5292F42}

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\


I use the tool 'Active Registry Monitor' to find out what is changed to the system.

I found the key i have published earlier:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5CBF8C22-E9A6-11D7-90FE-000AE4012DB4}


Its a different key and its not blokked in SpywareBlaster

If you dont believe me just test it. ( on your own risks)


Greetz

alphaZer0

 

I believe you, but don't worry: I will.

Regards,

Pieter

 

Thanks

alphaZer0

 

Nice catch!

I'll have protection for this added in the next database update of SpywareBlaster.

Thanks!

Best regards,

-Javacool