Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ntptdb] 'Start' = '00000002'
- '%TEMP%\scm.exe' start %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' install %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' stop %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- <SYSTEM32>\sysloader.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inifid
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\19.sys
- %TEMP%\nsx2.tmp
- %TEMP%\nsx3.tmp\System.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm19.exe
- <SYSTEM32>\sysloader.dll
- %TEMP%\nsx3.tmp\System.dll
- %TEMP%\scm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\19.sys в %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm19.exe в %TEMP%\scm.exe