Long Distance Charges

[SARGE]

I've had alot of customers recently with outrageous long distance charges - some are in the thousand dollars range. They are billed to the line used for Internet. When one tries to direct dial the # listed on the bill, the call fails. The best I've been able to determine is they're going to a site (probably porn) and clicking something like "talk to Molly, etc", and it then dials some programmed # behind the scenes and then charges are incurred. Of course everyone in the household denies anything and insists someone is tapping the line. I explain if that were true, why can't the # on the bill be "direct dialed?".

Anyone have any knowledge about the possibles?

[Xayd]

Yup, I'd bet my money on your theory as well.

Seen alot of this stuff. Porn sites team up with a telco in some third world country, and charge people 4.50 a minute to call a BBS overseas.

[Kento]

There's a porn dialer spreading all over the net and i've seen it infect a bunch of people's systems and they never wanted it. The customers you mentioned might have it and some if not all av programs now detect it. Have them do the 3 finger salute and see if they see openme.exe and/or something like 5-2-46-112.exe. If it's there here's how to remove it manually or they can run Ad-aware. It now gets rid of this porn dialer.

1. Go into add/remove programs in the control panel and look for something called WebDialer and uninstall it if it's there.

2. Press ctrl + alt + del and 'end task' on openme.exe. Also see if there's something there that looks like 5-2-46-112.exe. If so end task on that too. The name of the second file may have different numbers but it'll be similiar if it's there.

3. Then click start--find--files--and search for openme.exe. When found delete it. Then search for the other file I mentioned if it was listed when you did a ctrl + alt + del and delete that too.

4. Click start--run--type system.ini and click ok. In system.ini look for this line near the top:

shell=Explorer.exe openme.exe

Delete ONLY the openme.exe part so that it just says shell=Explorer.exe with nothing typed to the right of it. (Be careful deleting so that you don't start deleting the system.drv line underneath.) Then close system.ini and click yes when prompted to save changes.

After restarting go into the Temp folder at c:\windows\temp and delete everything in it. The dialer may have placed some files in there.

For XP users, instead of the system.ini edit you need to do this:

Click start--run--type regedit and click ok. Doubleclick on each of these:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon

Open the Winlogon key. In the right pane you'll see a value that looks something like this:

"Explorer.exe openme.exe"

Right click on that value, select Modify, and delete ONLY the openme.exe part. Leave the Explorer.exe part there. Then click ok and close regedit.
------

But as I said, Ad-aware now removes this porn dialer.

[Kento]

By the way, a good thing to do that might prevent one of these porn dialers from automatically installing itself is to go into internet options--advanced tab--and uncheck 'enable install on demand' then ok out. If there are two of those uncheck them both. That option which is enabled by default for who knows what reason can allow websites to install garbage into your computer without your permission. That may be one way these porn dialers get into people's systems. With that option disabled, if one tries to automatically download you'll be prompted about it and you can click no to stop it.

[SARGE]

Originally posted by Kento By the way, a good thing to do that might prevent one of these porn dialers from automatically installing itself is to go into internet options--advanced tab--and uncheck 'enable install on demand' then ok out. If there are two of those uncheck them both. That option which is enabled by default for who knows what reason can allow websites to install garbage into your computer without your permission. That may be one way these porn dialers get into people's systems. With that option disabled, if one tries to automatically download you'll be prompted about it and you can click no to stop it.

That's good info, and thanks.

[HAL9000]

There was a guy in Ontario that created a similar system and they were never able to bust him with the laws in place at the time. If you went to his site, he advertized free porno, you just had to download his special viewer to see them. Well, the viewer, when executed would follow a series of commands to disconnect you from the internet (assuming dialup), turn off the modem speaker, dial a 1-900 number to Russia at $4.99 per minute, run through an exchange to a second 1-900 number back to his servers at $4.99 per minute to all the free porn that you wanted. He did have in his license agreement for the viewer specifically that 1-900 charges may be applied at a double rate, but nobody reads the agreement. They were never able to bust him on it and many people had phone bills in excess of $2000. The phone company said they would back charge the excess billing if people came in to explain what happened, but apparently, an astonishing majority just paid their bills rather than admit to surfing porn.

[SARGE]

A word to the wise: Check your monthly long distance bill. Regardless of how small a particular charge may be, if you didn't make the call, protest the charge. If you pay it, you're acknowledging responsibility. Next month, when that charge becomes big bucks, you'll naturally protest, but telco will say, "you didn't mind paying the $1.00 last month, but this month it's $400 and you're protesting?"

[RayH]

A service of our phone company is to be able to block long distance without first having to dial a code. I have no long distance land line carrier and 900 and 976 are blocked!

[SARGE]

Originally posted by RayH A service of our phone company is to be able to block long distance without first having to dial a code. I have no long distance land line carrier and 900 and 976 are blocked!

So were the customers I referred to.

[Harry]

Yep, it happened to me. Except when the porno page came up, I clicked cancel and that ended up installing their dial up window which looked just like the windows dialup window which I normally use. When I logged back on, my system worked very slowly and I was trying to get out of that site. I never even saw any porno but ended up being charged $160 on my phone bill.
When I complained to the Pacific Bell, they said that the call went to some island and that there was nothing they could do and that I would have to pay.