Home Malware Programs Dialers Nunci

Nunci

Posted: March 28, 2006

Nunci is a dialer that connects your PC to the Internet via high-cost phone number using a modem. It also changes the web browser's default start and search pages. Nunci can be installed to the computer while visiting some web sites.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 snss.exe
    2 sys.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunconnector=%System%Winxsys.exe-nHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunsnss.exe=%System%snss.exe
  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}54F7FD6E-E782-4F9F-8FF0-677090048729AE71A324-1EF2-40BC-ADDC-30FD9CF95F87FFB51760-344E-4FFB-BFFF-4B18C7AC1D63AC5ACED1-97DB-4A2A-81A9-ACFC8ECA1085

Related Posts

Loading...