In addition, the browser Trojan. startpage. TNS/nwlnksipx. sys is hijacked.

EndurerOriginal
1Version

Yesterday, a friend said that his computer had detected a virus and asked me to help.

The pe_xscan scan log is downloaded and analyzed. The following suspicious items are found:

Pe_xscan 07-03-17 by Purple endurer
2007-5-6 10:35:46
Windows XP Service Pack 2 (5.1.2600)
Administrator user group

O2-BHO ieobject class-{5f5422f7-7159-4cb6-be7d-2c7eed316762}-C:/progra ~ 1/common ~ 1/yehoo. dll

O4-Global startup:-20676.lnk-> C:/Windows/system32/-20676.exe
O4-Global startup:-20844.lnk-> C:/Windows/system32/-20844.exe
O4-Global startup: rdgjhd. lnk-> C:/Windows/system32/rdgjhdi.exe

O23-service: nwlnksipx (nwlnksipx)-C:/Windows/system32/Drivers/nwlnksipx. sys (automatic)

Use hijackthis and the Security Assistant of rising star Kaka, and then use auto_del to delete nwlnksipx. sys at next startup.

This stuff was once encountered in the omnipotent search (wanso, Trojan. adplayer. A) and so on.

File Description: C:/Windows/system32/Drivers/nwlnksipx. sys
Attribute: ---
Language: English (USA)
File version: 5.1.2600.80
Note: nwlink2 sipx protocol driver
Copyright: Microsoft Corporation. All rights reserved.
Note:
Product Version: 5.1.2600.80
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
Legal trademark:
Internal name: nwlnksipx. sys
Source File Name: nwlnksipx. sys
Creation Time:
Modification time:
Access time: 10:32:30
Size: 6144 bytes, 6.0 KB
MD5: cbb860ee6715a2a968d19d0cd5eaaa7e

Kaspersky reportsTrojan. win32.startpage. amoThe rising report isTrojan. startpage. TNS.

Scanned file: nwlnksipx. sys-infected

Nwlnksipx. sys-infected by Trojan. win32.startpage. amo Statistics: Known viruses: 315008 Updated: 07-05-2007 File size (Kb ): 6 Virus bodies: 1 Files: 1 Warnings: 0 Archives: 0 Suspicious: 0