Dialer.Webcont

[TJ]

Behavior
Dialer.Webcont is a dialer program that attempts to dial a high-cost number using a modem.

Symptoms
The files are detected as Dialer.Webcont.

Transmission
May be installed when certain Web pages are visited. The user must agree to the installation.

technical details
File names:
un.exe

When Dialer.Webcont is executed, it performs the following actions:

   1. Copies itself as C:\un.exe.

   2. Makes an outgoing connection to a server by dialling a high-cost number using the modem.

   3. Attempts to access the following Web site:

      [http://]www.webcont.net/[REMOVED]/CONT

   4. Deletes all URL cache, URL history and the following registry subkeys:

      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDoc
      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMPU
      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedURLs

   5. Creates the following registry subkey:

      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Un1

To delete the value from the registry
   1. Click Start > Run.
   2. Type regedit

      Then click OK.

   3. Navigate to and delete the subkey:

      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Un1

   4. Exit the Registry Editor.