Did something very unusual today. I now have my own serial modem in a VM (based on vmodem from the protoweb community) so my physical retro PC can dial out. I had that for a while but finally having it in a VM makes it fun to use it again since setting it up on a proper linux install was always really difficult to do well.
I am into old malware that has interesting effects and I remembered one of the dialers I discovered back in 2004. After some digging I got the activex cab for it and with the help of AI I got a html file to trigger its install. It worked really really well. Its a browser hijacker from bill2000 which has a 2001 era startpage bundled. Those startpages were very popular in my country and contained links to all kinds of popular sites as well as a search bar. They clearly mimicked that, although no search bar. Its full of links to popular sites, but since its malware it has multiple pay sites in between the links that cost 1.50 per minute and in the later version 70 cents per minute. I clicked on one after the vmodem script was touched up to correctly ppp dial on any number. This tricks the dialer into thinking that its a legit authentication.
Did some digging online as well for fun ones. There is HotXXX which allegedly is related to the lop malware that I have in my collection (had a fun detour and found more older versions of that, the one in my collection wasn't available online so I uploaded it to a virus research website for vintage malware fans to have fun with). But this malware would apparently dial pay numbers every few minutes. Couldn't find it anywhere. I did find another one that calls itself that but it doesn't seem malicious neither was it related to lop.
As I got myself a small collection of them after a lot of link digging in the waybackmachine I can basically conclude how the dailers work. There is no authentication whatsoever. It counts if there is a successfull dialup connection. All of these numbers act identical to a PPP internet provider. The paysite was likely walled off to its own provider so any real verification would be done on the backend there. I'd love to emulate that somehow but I don't have a good method to do seperate proxies on the vmodem side.
Some dialers are also kind to put the current charge on the screen. One completely managed to hide the adapter but was still showing rates at least. The startpage hijackers one is more basic and doesn't give an indication you are connected to it. When I played around with it in 2004 we had adsl (hence safe) so I don't know what indicator there is if you do access the site for real, but i'd assume they don't show and hope you forget that your internet is now at 70 cents per minute on top of your phone bill.
Now you might be wondering, what kinda site are the dialers for? Your first guess is probably correct I don't even have to mention it, although category wise some you may expect are missing and stuff that you would not expect is there. But there are genuine surprises and they had some incredible access to some domain names, for example "alcoholvrij" which translates to alchohol free which seems to be a dialer paywalled anti alcohol site of some sorts. There was a website about cars. A flash game website (which is how I discovered it when I was young). And some coloring website for kids! Yup, they had a paywall young kids website which name implied it was where they can color images. So your toddler can spend some fun coloring when they see that page on the startpage of the browser, at 70 cents per minute of course.
Another cheeky thing, of all the dialers I tested none of them automatically hang up on the windows side. They all disable the tick to auto hang up. Although most advertise maximum amounts, for example 48 dollars after which apparently it would have disconnected on their end.
How did they get away with that kinda rate? International lines that were fully unregulated back then.
The last but not least surprising thing about them, almost all of the ones I found had proper uninstall options although sometimes slightly hidden. They wouldn't always properly cleanup the dialup profile but they would at least cleanly uninstall themselves. Except for one which has no uninstaller at all, the browser hijacker of course. Now my windows 98 install still has a nostaltic 2001 startpage, and you know what? I actually like it. Gives it a bit of realism and helps me not get the errors of it trying to load way to modern sites right away before the proxy kicks in. Most of the links on it are real proper links after all, and I like the dialer aspect to since its all fun and games when its not a real modem.
Eventually if I am sick of it ill just delete the files to stop it from messing with my browser.
