"The process Shim Engine DLL belongs to the software Microsoft Windows Operating System by Microsoft Corporation (www.microsoft.com).
Description: ShimEng.dll is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 65,536 bytes (43% of all occurrence), 111,104 bytes, 65,024 bytes, 66,048 bytes. "
My notes...In my (XP) MCE 2005 with SP3 updates installed in the Windows installation, it's actual Size is 63.5 KB (65,024 bytes), it's Size on Disk is 64.0 KB (65,536 bytes) (the drive space it takes up)
(many files in MCE 2005 are identical to those in XP Pro 32 bit)
The file may be corrupted, or you may have malware - a RootKit - in which case the file may be a considerably different size, and it may not be running from C:\Windows\System32.
Application compatibility component, may be target for hacking
ddebug (further information)
Shimeng.dll ist ein Keylogger
Shimeng.dll is a Keylogger
i have detected rootkit activity with rootkit unkooker and gmer but this one is so well done almost nothing detects it
Ist ein Keylogger
Its a name of keylogger file...
adrian (further information)
At least one rootkit uses it, run Rootkit Unhooker to detect
user (further information)
It is basically used for side by side execution of .NET compliant application or CLR compliant application. Use to get the version information of other dlls and get otehr parameter from the host to run the CLR.
Sachin Gupta "
You're mixing up your forward slashes and backward slashes.
Forward slashes are used in internet addresses, and in command lines for some programs; backward slashes are used for locations of files or folders on your hard drive.
XP does not have Scan Disk - it has CHKDSK.
Running CHKDSK without the /F or /R switch doesn't fix anything.
Running CHKDSK /F or CHKDSK /R can't fix corrupted files, unless all that's wrong with them is they're crosslinked and fixing that restores the crosslinked file(s) to what they should be
Running SFC /scannow can replace essential missing or corrupted System files that are at the source it checks against, but it doesn't replace all corrupted or missing files that are in a standard Windows installation.
There are no messages about what it did or did not do. Restart the computer after it has finished running.
SFC /scannow will NOT accept the source of the files it checks against as valid unless the source has the same Windows SP updates integrated into it as the Windows installation on the hard drive does.
SFC /scannow cannot be used in Safe Mode.
To see the error message in Safe mode
Start - Run - type: cmd (click OK)
Then type: SFC /scannow (press Enter)
If SFC /scannow actually ran, it should take at least 15 minutes or so to finish, if not longer.
Assuming shimeng.dll is just corrupted (it's size in it's Properties when you RIGHT click on it would probably be one of the two sizes mentioned above in that case)
Search C:\Windows for: shimeng.dll
I have 3 copies of the exact same file
- one compressed and hidden at C:\Windows\$NtServicePackUninstall$
- one at C:\Windows\System32 where it's used by Windows
- one at C:\Windows\ServicePackFiles\i386
If you have the one at C:\Windows\ServicePackFiles\i386, copy it to C:\Windows\System32