Virus Name: PornDial-106
Variants/Aliases:

none known

Virus Type: Porn Dialer Program
Risk Assessment: Low
Minimum DAT required: (NAI/NAV) 4238/Not known at time of discovery
Virus Characteristics:

This is a porn dialer application that installs itself to run at system startup. A porn dialer is simply a program that is used to dial into a pornographic "service". Some porn dialers do not advertise that extremely high phone bills may result from using their service. PornDial-106 is not considered to be malicious as it does not conceal its presence in any way and does come with an uninstaller. However, /PROGRAM detection is being added for this "potentially unwanted application". The current command-line scanner makes use of such detections, as does VirusScan 7.

Several registry keys are created by this application.
HKEY_CURRENT_USER\Software\Webdialer\li-thund00001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run "li-thund00001" = c:\program files\Webdialer\li-thund00001.exe -m
The program copies itself to the C:\PROGRAM FILES\WEBDIALER directory and creates shortcuts in the START MENU and START MENU \ PROGRAMS directories, as well as on the DESKTOP. User may use the ADD/REMOVE Programs Control Panel item "Webdialer - Webdialer - Account-li-thund00001" to remove this program.

Symptoms: N/A This is a "potentially unwanted application"
Method of Infection: N/A This is a "potentially unwanted application"
Removal Instructions:

All Users:
Use specified engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations