Adultoweb Dialer was first discovered in June of 2003.  It is distributed by Creanet S.A., a known developer of Porn Dialers.  While it is typically transmitted from websites promoting pornography, it can be transmitted from nearly anywhere else.  It is of French origin.

Adultoweb Dialer, just like most dialers, is stealthily installed on your computer by an ActiveX drive-by download.  It has also been seen to be manually installed in some cases.  Some of its hosting sites are (or have been) fsexy.com, http://hometown.aol.com/DesiretSory47/dialer.lusval.html, and partouze.fr.

Adultoweb Dialer attacks by hijacking your computer’s dial-up modem.  It starts with a pop-up window showing the Terms and Conditions for using their product, which appears every time it starts up, and explicitly states what this program is, what it does, how much it costs, and that you should be 18 or older to use it.  It then exploits it to call “900” phone numbers instead of your usual Internet service.  This will result in enormous phone bills that you will have to haggle against.  Creanet shares in the spoils with the phone number’s server, if it’s not them doing it.

Adultoweb Dialer also comes bundled with other Dialer programs, Trojan Backdoors and Downloaders and possibly some Worms.  If you discover that you are infected with Adultoweb Dialer, you should remove it immediately with SpyZooka.

Also Known As:
Dialer.Lusval (Symantec)
Dial/Laet-B (SOPHOS)
Global Cash Solutions Dialer
Dialer.GlobalCS_Dialer
multicrack

Spyware Type:
Dialer

Associated Files:
NsUpdate.exe
multicrack.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “NsUpdate”=”%Windir%\NsUpdate.exe UPDATE”

HKEY_CURRENT_USER\SOFTWARE\ “GlobalCS”

HKEY_CLASSES_ROOT\clsid\ {23273a1c-c870-43c4-a3e3-67dc98630ac6}

HKEY_CLASSES_ROOT\clsid\ {FFFB1D8B-88D6-4C91-BB62-378625E8C73E}