Scan Log
Version of virus signature database: 3394 (20080827)
Date: 2008-8-28  Time: 5:47:52
Scanned disks, folders and files: G:\v\27scan.rar
G:\v\27scan.rar » RAR » 27scan.exe - a variant of Win32/Kryptik.E trojan - was a part of the deleted object
Number of scanned objects: 1
Number of threats found: 1
Number of cleaned objects: 1
Time of completion: 5:47:52  Total scanning time: 0 sec (00:00:00)

Kaspersky miss
TO KL

Dr.Web
Trojan.Packed.619.

Hello,

27scan.exe - Backdoor.Win32.Frauder.bn

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 27scan.rar

efenseWall HIPS log file

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 lphc17dj0ej11 在注册表键 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (注册表)

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 lphc17dj0ej11 在注册表键 HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ (注册表)

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 Personal 在注册表键 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 Common Documents 在注册表键 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 Desktop 在注册表键 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

08.28.2008  09:16:02，模块 C:\Documents and Settings\htyhzd\桌面\27scan.exe， 企图 设置值 Common Desktop 在注册表键 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

红伞miss了。。。

NIS2008  飘过

微点拦截

NOD32 搞定!