Hi, One thing that can cause the missing file error you have for Encarta Encyclopedia (shrl30.dll) is the Sircam virus;;; there is a free remover here that will run and remove or tell you the virus is not present- that will rule out Sircam. There are other reasons for this error.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314599
After reading the info, scroll down to the "Availablity of W32.Sircam...............etc" and get the remover, run it from the desktop, reading instructions and all.........
There are some things in the HJT log that must go:
O2 - BHO: (no name) - {4CEBBC6B-5CEE-4644-80CF-38980BAE93F6} - C:\WINDOWS\IEXPLORR23.DLL
O2 - BHO: (no name) - {6B12DABB-0B7C-44FA-B0B3-4BAFF3790256} - C:\WINDOWS\IEXPLORR24.DLL
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\BTLINK.DLL
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50015/btiein.cab
However, these may not go easily in Normal Mode, so try from Safe Mode- here are directions for reaching Safe Mode:
If you already know this, just run HJthis from Safe Mode, and have it fix those entries....sometimes, not even this works and you have to end those processes first, then use HJT to fix them.
Only a reboot and rescan with HJT will tell you if they are gone.
You must then hunt for those files which may or may not be present, and delete them if present.
http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam
AdAware and SpyBot would detect and remove Huntbar (BTEIN.DLL indicates that) do you have either of these free malware removal tools? You should! Update and run them if you do already have them installed. AdAware has special settings- let me know if you do want AdAware and will post the directions, but they are in many threads here in Security forum.
The IP adress 127.0.0.1 is your own computer's. That should mean the infection or whatever is present and as you say, attacking internally....the internal address is the same for all computers which is why you saw it the same in another post.
The returned emails are bogus, your email addy has been picked up by some other infected computer and used or "spoofed" making you the recipient of the returned mails....which also may contain a virus.... so, until it gets straightened out, you may continue to get these, many many people are also having this problem. There may be a way to block them, but that can also block some mail you do want...
The Norton Security error I am not sure about, perhaps it was installed badly and just needs to be totally uninstalled/reinstalled....that can be a real pain, but sometimes goes well and does fix the problem....we can work that out after the main problems are fixed.
Somewhere along the line you probably should scan for worms/Trojans not just viruses....
There may be some other things to do.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314599
After reading the info, scroll down to the "Availablity of W32.Sircam...............etc" and get the remover, run it from the desktop, reading instructions and all.........
There are some things in the HJT log that must go:
O2 - BHO: (no name) - {4CEBBC6B-5CEE-4644-80CF-38980BAE93F6} - C:\WINDOWS\IEXPLORR23.DLL
O2 - BHO: (no name) - {6B12DABB-0B7C-44FA-B0B3-4BAFF3790256} - C:\WINDOWS\IEXPLORR24.DLL
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\BTLINK.DLL
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50015/btiein.cab
However, these may not go easily in Normal Mode, so try from Safe Mode- here are directions for reaching Safe Mode:
If you already know this, just run HJthis from Safe Mode, and have it fix those entries....sometimes, not even this works and you have to end those processes first, then use HJT to fix them.
Only a reboot and rescan with HJT will tell you if they are gone.
You must then hunt for those files which may or may not be present, and delete them if present.
http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam
AdAware and SpyBot would detect and remove Huntbar (BTEIN.DLL indicates that) do you have either of these free malware removal tools? You should! Update and run them if you do already have them installed. AdAware has special settings- let me know if you do want AdAware and will post the directions, but they are in many threads here in Security forum.
The IP adress 127.0.0.1 is your own computer's. That should mean the infection or whatever is present and as you say, attacking internally....the internal address is the same for all computers which is why you saw it the same in another post.
The returned emails are bogus, your email addy has been picked up by some other infected computer and used or "spoofed" making you the recipient of the returned mails....which also may contain a virus.... so, until it gets straightened out, you may continue to get these, many many people are also having this problem. There may be a way to block them, but that can also block some mail you do want...
The Norton Security error I am not sure about, perhaps it was installed badly and just needs to be totally uninstalled/reinstalled....that can be a real pain, but sometimes goes well and does fix the problem....we can work that out after the main problems are fixed.
Somewhere along the line you probably should scan for worms/Trojans not just viruses....
There may be some other things to do.
