[ptw007]

I have crashed 1 Laptop and 1 desktop in the past 2 weeks. I had to take my laptop to a Toshiba specialist who had to bypass a password protected Dos Root (which I did not set). The technician also installed a new Segate Hard drive. After some trouble shooting I found that when I logged in to my Yahoo (and I think my Gmail), the virus followed my as I logged in. I did not realize that until AFTER I GOT MY LAPTOP BACK. However, I have been very causcious and I don't think the virus or spyware has gone to far into my existing laptop. SOMETHING IS MYSTERIOUS THOUGH!! I see some pop ups here and there that seem like something is going on behind the scene's.
I have run Spybot Search and destroy and fixed all, I have run Ad-aware and fixed all, AVG Syware and will post on this page, ran a COMPLETE TEST from AVG, tried to run Panda but for some reason it woulnt run, and finally, executed the HiJack.exe.
Everything RAN CLEAN and one may think ALL IS WELL! I have destroyed too many files and Computers and spent alot of money to just leave it at that. So, I would appreciate someone looking at my Hijack log, and the AVG logs to see if something is WRONG. Something that I may be missing.

I have also run CC Cleaner and Windows Update and all is up to date.

Thanks for you help.

Attached Files

•  hijackthis0201081030pm.txt   8.25KB   174 downloads

[Advertisements]

Hello ptw007, I'm currently reading over your log right now and I'll do my best to try to get your system clean

Since I'm still in training, there may be a slight delay between my posts because they must be checked by an expert.

Regards

eddie

[eddie5659]

Hello ptw007, I'm currently reading over your log right now and I'll do my best to try to get your system clean

Since I'm still in training, there may be a slight delay between my posts because they must be checked by an expert.

Regards

eddie

[ptw007]

Thaks Eddie,
No Problem, I just happy that I have a second set of eyes to help with my problem. I have usually been good at trapping these guys and deleting them, but this one is a bastar........! Just a quick note that I forgot to mention. The hacker or viruos get me when I log into my mail (not when I read my mail cause I know better it you read the mail it executes. When I login, this Malware knows my username and password on Yahoo and gmail and as soon as I enter them and login, my address to those sites get re- retouted to a fake Yahoo or fake Gmail. I accedently logged into yahoo and few days ago and I immediately noticed some strange things happening. I just can't find it.
Take your time as I know you guys are busy plus I know that your spending more time on mine which is good.
Thanik soo much Eddie.

Pat

[eddie5659]

Jotti File Submission:

• Please go to Jotti's malware scan
  
• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  
  • C:\Program Files\Task Killer\TaskKiller.exe
• Click on the submit button
  
• Please post the results in your next reply.

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[ptw007]

hi Eddie,
I'm sorry it took so long to reply to you. I normally receive an email when you post a reply into my topic. I did not recieve any email so I just checked the log today and found that you replied to me back on the 4th of Feb. So, Sorry for the delay.

I am attaching the hiJack log, the combofix log and the Jotti's Malware scan log for your review. Please review and provide instructions for what I need to do , if anything.
Thanks
Pat

Attached Files

•  MalwareScan_For_Geeks.txt   3.9KB   148 downloads
•  combofixPatWarren.txt   15.83KB   130 downloads
•  hijackthis020208.txt   7.19KB   141 downloads

[ptw007]

Eddie,
Another quick note that may be a critical issue. Somewhat often, i receive a pop up rundll32.exe - Bad image C:/Windows/sytem32/ShimEng.dll (is not a valid windows image). What the heck is this. I did a google search on it and came across this link (but I could'nt run the applications that was listed on the Geeks to Go log (http://www.geekstogo...ys-t30743.html. Hope this provide the info you needed

Thanks
Pat

[eddie5659]

That's okay, I understand about the notifications, as its happened to me before

With regards to the original issue, all logs are coming up clean. However, you do need system Restore enabled, as it appears to be disabled. But, we'll enable that once everying is sorted

Also, running p2p prgrams is not advisable, as they are a major scource of viruses/malware.


Now, with regards to the second problem, is this happening online, or offline? If its offline, does it occur randomly, or when installing something?

See if this helps:

1. Click Start, and then click Run.
2. In the Open box, type cmd, and then click OK.
3. At the command prompt, type the following lines and press ENTER after each line:


regsvr32 ShimEng.dll

4. Click OK when you receive the message that DllRegisterServer in FileName succeeded.
5. Type exit.


eddie

[ptw007]

Eddie,
Things have gone from bad to worse and even more worse. In a matter a few hours from my last post. Error are poping up everywhere. The ShimEngr.dll pop up when I try to load certain apps like, add/remove, spybot , wireless connection, and misc others. In addition, I am getting multple errors when I try to do a restart. Power saver problem is one, and I hav'nt had the chance to cathch the others. Through out the day, I have been google serching the errors (from tech forum logs to include Geeks to Go and Have followed the instruction on that post, but that was a bad Idea. it's locking up all the time and in fact it had taken OVER KASPERNSKY INTERNET SECURITY 7 --- How CAN IT DO THAT, ITS THE BEST. Now, when I restart, Kasp. tries to load but an error says this package ( is locked by the admin). So it wont work now. Finnally, after several attempts to do a restart, with no luck, I powerd off by holding down the power button for 5 seconds. Now I am back up but in Safe mode with Networking. The problem now is, I cannot connect into my wireless router for some reason. I am sending you this message frm another computer. What can we do? Is there any hope. Please tell me yes.
Thanks Pat

[eddie5659]

Can you try the above with the ShimEngr.dll, and if it doesn't work, post the message that appears. As for the other error's, can you post what they are, as in if its a file not working (which one), etc.

Can you remember what you've already tried, after searching the web? If not, its okay.

Are you the Administrator of this computer, or is it part of a network?

eddie

[ptw007]

Eddie,
Sorry once again. My computer has been down for 3 days from this whole thing. Now my wireless adapter/Network/ everything is totally non functional. I have spent 2 days trying to fix in though dos and it was a waste. I am now (as of 3 hours ago, back online via and Eithernet LAN (wired) connection. I'm not sure why I did'nt think of that before.
BUt again, I think that issue is tied into the SHimmENG.dll problem.
Now,I did run the regsvr32 application (shimEng.dll) and an error responded " SimEng.dll was loaded but the DLL REGISTER Server entry was not found". Any ideas.

TO answer other question from you. I am the computer admin (just by default_) however, orinianlly I was a novice and over the past 6 months or so, I have really learned the inner workings of my computer. I am somewhat advanced now with alot of things.
In regard's to the re-occurence of this problem. THis is one that had baffled many forums and actually, the TOshiba tech who brought it back to life (new hard drive) , has'nt heard of this type of virus ( if that what it is). It DOES (or acually DID) happen online in YAHOO MAIL . At first I thougt it was Google , but have narrow my focus to Yahoo. After the original crash (1 month ago), I needed to use other comp's for email etc and while logging into my mail, That's when things started to happen ( 2 computers were trashed the same way). I don't know if this makes any sense but this virus , actually hackers have attached somethhing to my mail (i think). I noticed when logging in, weeks ago, that at the bottom right of IE7, thaddresss were just flying by with redirects, false routing, hidden identity trackers, etc which usually brought the brower to be hung where I needed to restart. I learned my lesson, though , after the 4th time logging into mail. I really never would have thought that was where it was (still not sure). Anyways, I have not logged into Yahoo in weeks and I have now just begun to retrust Google. I have been using my MSN/Hotmail email program for the past month. Now remember, upon my intial awareness of the this virus/hacker, I was always online - that's when it started, Not after downloading any software, or going through unused files. offline.

I think it's important to note that (I think thanks to Kapernsky Internet Security 7), this time around I have been able to keep this virus in check. It's not having the opportunity to start is damage again. I have set so many TEMPORARY security issues on and offline and my eyes are always open for strange activity.. Other that the Rundll.exe, Shimeng.dll issue , and My wireless Router being completely disabled, My computer is runny very fast and it's responsive. I continually runn Adware, Spybot, XP diagnotic tools, and many other app's to either identity the problem or at least keeep it at bay. Oh, another error that I keep getting is "Toshiba Power saver.exe has a critical error , or, somethinglike that. One other thing, the ShimEng.dlll issue is happening more and more frequently as days go buy. It happens when I do a Systems Property view, Add/Remove progam in Control Panel, and many other Systems applications. I have download this new tool from Microsoft that I just wonderfull (New Windows Support Tools). It outlines several .dll process's that I can run via the DOS prompt. It's taken ME Hours upon hours and days upon days to learn this thing. It really is a great to however , to learn and know how to run in dos. In retrospect, [bleep], it's has'nt really been able to help me with these problems though.

I really hope that my rambling is not a waste of your time, I just really thought that I should be AS DETAILED AS I POSSIBLY CAN BE. This promblem SEEMS TO BE very Advanced.

ONe final thing. In regard to your question about my Google search, I have so many saved bookmarks of where I went, but to give you details on which site gave me what, forget about it (terrbile memory). I remember specifically though the geeks to go Capture that was saved in Google that seemed to relflect my problem (her registry even looked similar to mine). I just remember that what was suggested in that topic post, would not run for me ( the links/software that was to be run by that person at the time).

Hope this helps,

pat

[ptw007]

Eddie,

Here's my latest Hi-Jack Log. I need to snd it to you again, because things are really heating up again.
Both Adawr and SYpbot Search and Detroty have now detcted the Virus. I think the virus is in th ShimEngr.dll area (Windows/systems32) but I'm no proffesional.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:24, on 2008-02-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\Toshiba\ivp\ISM\pinger.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Patrick Warren
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [Pinger] C:\Toshiba\ivp\ISM\pinger.exe /run
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKUS\S-1-5-21-2599080873-354353182-606245882-1006\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-2599080873-354353182-606245882-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-2599080873-354353182-606245882-1006\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart (User '?')
O4 - HKUS\S-1-5-21-2599080873-354353182-606245882-1006\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook (User '?')
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Look up in Mr&Check... - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\tumrcheck.htm
O8 - Extra context menu item: Open in &new window - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\tuofinw.htm
O8 - Extra context menu item: Search with &Google - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gsearch.htm
O8 - Extra context menu item: Show page from the &cache - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gcache.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.updat...b?1203247666063
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1201220831311
O16 - DPF: {A364AF35-0CDF-41E8-8F3B-E0E55E15EBA1} (Zenturi Active Programs Control) - http://www.programch...m/dll/nixon.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 9740 bytes


Please try and move my case up on the Priority level because I Have been patient for a while now (close to 3 weeks). I have no SOLUTION and my PC is in very bad shape. I REALLY NEED greater attention paid to this CAsE>

Pat

Attached Files

•  ShimEngr.dll_Error.txt   456bytes   147 downloads

[eddie5659]

Sorry for the late reply, my cable connection died due to the weather over here

Do you have the original copy of Windows XP on disk? If not, if XP was already loaded on the system, try this:

Go to Start | Run and type the following:

sfc /scannow

And press OK.

This will replace any corrupt or damaged files on your system.

eddie

[don77]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.