Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ntptdb] 'Start' = '00000002'
- '%TEMP%\scm.exe' start %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' install %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' stop %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- <SYSTEM32>\sysloader.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inifid
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\13.sys
- %TEMP%\nsw2.tmp
- %TEMP%\nsr3.tmp\System.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm.exe
- <SYSTEM32>\sysloader.dll
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\scm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\13.sys в %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm.exe в %TEMP%\scm.exe