Premium Number Scam

Dec4 · 25-03-2004 1:27pm #1

Hi,
Recently on my phonebill I have been charged for a number of premium rate calls to a certian 1580XXXXXX number. When I requested an itemised bill I find that these calls are occurring when I have connected to 1892150150 ( Eircom.net ISP ). At some stage during this internet call the number switches to the 1580 number without any warning. So I'm paying €2.00+Vat / min!! Have checked my Dial Up settings etc and ran a virus check on PC but to no avail. Needless to say eircom.net are their usual helpful selves on this matter. Not our problem...
Anyone shed any light on this matter??

theciscokid · 25-03-2004 2:16pm

well a 1580 number is charged at €1.90 per minute

the office of the Regulator of Premium Rate telecommunications monitors content and promotion

ph : 1850 741 71 or 676 7025

as in says in the book

Should you wish to bar access to Premium Services from telelphone call 1901

This Barring Facility Is Free Of Charge

whats the full number?

the above numbers should at least tell you what the promo is, or who runs it!

It could be a cock up on eircom's part, as you say if you connect with 1892 150 150

i find it hard to believe that it can just "switch" half way thru ur call

Dec4 · 25-03-2004 2:33pm

I stand corrected on €1.90 + Vat. I have already been in touch with Regtel who have given me the name of the company operating this premium service. They claim to have barred the number that was being called via this 1580 number but they say that calls are then rerouted to a different international number.
As you say I can bar premium calls but Eircom say I have to bar ALL premium numbers. How do I then contact my ISP?? ( a 1550 number ).
No one accepting liability anywhere amongst this intricate web...

theciscokid · 25-03-2004 2:38pm

Well hardly anyone rings premiun rate numbers i mean unless you ring sex lines

no harm getting them barred

1530
1540
1550
1559
1560
1570
1580

can u print the number that came up on ur bill the

1580 one please?

Dec4 · 25-03-2004 2:42pm

In fairness to the operator of service I'll give them one more chance to sort it out. If they don't / can't I'll happily post the full 1580 number. You dial it to make "cheap" international voice calls..

joePC · 25-03-2004 7:08pm

Sounds like spyware, if for example a pop up window appeared asking you to install a program and you click yes, 9 times out of 10 its a dialer, it closes your connection to eircom and connects to the €2 / min number,

Get your self Spybot S & D or Ad - aware 6 and scan your system.

Thanks joePC

Karoma · 25-03-2004 7:22pm

AV Scanners do not detect all malware - you probably installed a dialer - it's not a virus, it's nasty perhaps, but it does what it's supposed to... get a prog. to scan for spyware-it might recognise it. And do not install silly stuff like that in future.

(Also, check the "alternative number" in your isp's dial-up connection-it's probably dropped and re-dialled with the alternative number (thinking aloud))

Tom Dunne · 26-03-2004 12:52am

Originally posted by theciscokid

It could be a cock up on eircom's part, as you say if you connect with 1892 150 150

i find it hard to believe that it can just "switch" half way thru ur call

Nope, classic porn dialler. It hiijacks your internet connection to dial the premium rate number screwing you in the process, no pun intended.

The next-door neighbours 19 year old son had an unfortunate, er, occurance of such porn dialler. It took me ages to uninstall the fecker. When they got onto Eircom, they were not interested and the numbers were no longer in service, so there wasn't a damn thing they could do. It cost them around 200 Euro.

Dec4 · 26-03-2004 2:06pm

Many thanks for helpful suggestions.
Not foolish enough to install program from popup window.
Have checked dial-up settings incl. alternative dial-up number.
Will try spybot as suggested - Source ??
Tom - How did you manage to uninstall it ??
Cheers all...

Tom Dunne · 26-03-2004 6:34pm

Originally posted by Dec4

Not foolish enough to install program from popup window.

You really don't have to be foolish. They use every trick in the book to get you to click on a button. I got nabbed 'voting' for the site I had just come from (a MAME ROM site, not that kind of site). It also happens very, very quickly, so you don't realise what is after happening.

Originally posted by Dec4
Tom - How did you manage to uninstall it ??

As you can imagine, it's not your standard un-install.

Firstly, I deleted the folder it was in. Secondly, I fired up regedit and removed every reference to the .exe I could find (and anything else for that matter). After a reboot, the friggin' thing re-installed itself.

So I did the same again, found a convenient un-install program for the dialler and stupidly clicked on it. Of course, it re-installed the dialler. In the end, a full delete of every single file resembling anything remotely similar to the name of the .exe (did a search on all the directories on the C:\ drive - it gets into a lot of directories, including C:\windows). Removed every last registry entry sounding anything remotely like the .exe (you get the idea). It was a pain.

Dec4 · 30-03-2004 10:07am

Many thanks for assist..Spybot Search & Destroy seems to have done the trick. Just to be sure to be sure I have also blocked all premium numbers ( 15xx xxx xxx ). Incidentally the nasty I think was svchost.exe which had appeared about 6 months previously on PC. Thought I had got rid using Norton Anti-Virus.
Managed to get someone knowledgeable at Eircom.net who told me that the number of such cases has mushroomed recently. Quoted one example that day of a guy stung for €800!!

MrPinK · 30-03-2004 12:09pm

Originally posted by Dec4
Incidentally the nasty I think was svchost.exe which had appeared about 6 months previously on PC.

svchost is actually a system processess that handles all the services running that are implemented in DLLs rather than stand-alone executables. It runs many system services as well as services for programmes you have installed, so it is normal for it to be running. It would have been one of these services running under svchost rather than svchost itself that was the problem. To list the services running you can run tasklisk /svc or net start from the command line

spongebob · 30-03-2004 3:30pm

Originally posted by Dec4
Quoted one example that day of a guy stung for €800!!

Ring 1901 again and ask them to Block the Band 13 numbers (used only by porn and casino diallers ) because Eircom will charge you €3.61 a minute at all times to those numbers ....twice what a premium 1580 number costs as it happens.

M

Dec4 · 31-03-2004 3:28pm

Eircom tell me that Band 13 are International calls and that the only way they can bar them are by barring ALL International calls.........

spongebob · 01-04-2004 10:17pm

mail info@comreg.ie and tell them you want to selectively bar them as they cost €3.61 a minute which is twice what a premium number costs.

M

Premium Number Scam

Comments