Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ntptdb] 'Start' = '00000002'
- '%TEMP%\scm.exe' start %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' install %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- '%TEMP%\scm.exe' stop %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\06.sys
- %WINDIR%\Temp\sys_loader.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm.exe
- %TEMP%\nsf2.tmp
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\scm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\06.sys в %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Office\SYSTEM\scm.exe в %TEMP%\scm.exe