Gladiator Security Forum > Soothsayer's thread

Gladiator Security Forum > Malware Help Forum > HELP! Think you are Infected?

soothsayer

Dec 9 2004, 07:01 PM

Bobbi,

I have had similar issues with guard.tmp and entries in my hosts file. After repeated running of Adaware and Hijackthis, the hosts file and guard.tmp have stopped appearing, however I have found this - everytime I reboot, I see a number of new .dll files in my system32 folder. (enjql1151.dll, e0202afmgd2a2.dll, arsnds.dll, etc all around 219KB in size).

I found this registry key - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex -> DllName C:\WINNT\system32\enjql1151.dll

Any ideas whats happening here?

Bobbi Flekman

Dec 10 2004, 11:29 AM

Please post a HijackThis log so I know what I see.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.