An ActiveX drive-by-installer for premium-rate phone diallers.

Variants

OnlineDialer/MaConnect : filename MaConnect.dll, object name 'Loader class', typically downloaded from online-dialer.com.

OnlineDialer/eConnect : filename eConnect.dll, object name 'eConn class', typically downloaded from libereco.net.

OnlineDialer/IEDialer : filename IEDialer.dll, object name 'IELoaderCtl class', typically downloaded from libereco.net.

OnlineDialer/VLoading : filename VLoading.dll, object name 'Download class', typically downloaded from 0190-dialer.com.

OnlineDialer/SunInfo : filename SunInfoConnect.dll, object name 'snConnect class', typically downloaded from 4netmedia.com.

OnlineDialer/BelCall : filename BelCallConnect.dll, unknown origin.

Distribution

Installed by ActiveX drive-by-download on many sites, pop-up ads and junk e-mail (spam), typically porn-related

Some particularly aggressive installer pages open a JavaScript error and try again if you click 'No' to the install box, to try to force you to install the software. In this case all you can do is go to the Task Manager (Ctrl-Alt-Delete) and kill Internet Explorer.

Advertising

No.

Privacy violation

No.

Security issues

Yes. Any web page can direct it to install arbitrary executable code downloaded from its home server.

Stability problems

No.

Removal

Common anti-spyware titles can remove the VLoading and SunInfo variants of OnlineDialer.

Manual removal

Ensure Internet Explorer windows are closed, then open 'Downloaded Program Files' in the Windows folder. Delete the entry corresponding to OnlineDialer (it will have one of the object names mentioned above; the object name for BelCall is not currently known, but you should be able to check where it comes from by right-clicking them and choosing 'Properties').

OnlineDialer may have installed an unwanted dialler. Open the Program Files folder and delete the 'OnlineDialer' folder if you have it, along with the shortcuts it adds to the Desktop, Start, and Programs menus.