[Shark01]

JJJ999, you said you typed in: C:\system 32

You need to type in: CD "C:\WINDOWS\system32"

You left out the "CD" the "WINDOWS\" the "quotes ("")" and added a uneeded "Space" in between "system" and "32" if you really typed what you said you typed.


Typed it EXACTLY as dancoppock typed it.

It worked for me.

[JJJ999]

Sorry about the errors in my fast typing shark, I did type exactly what dan typed, spaces, quotes, and all. After the C: it says it doesn't match internally or externally, and after the RMDIR it says that the file can't be found.

[JMG777]

The system restore worked for me and I'm not much of a technical person. You can follow the instructions at the following link: http://support.microsoft.com/kb/304449 to restore your system to a date before the runtime error 21 issue occurred.

I was also able to do this by booting up in the "safe mode" (meant to boot up in safe mode - command prompt) and then was given the option to restore the system so I just tried it and it seems to have worked. The annoying windows are gone. Good luck.

[djmellowfellow]

Hey, I've tried using HijackThis as suggested by some peops. In normal mode it shows up some files which end with the virus (ncsjapi32.exe). However, I've no idea how to use HJT in Safe/Command Prompt mode.

I've also tried Dancoppock's method but in fact I'm stumped when it gets to Safe/Command Prompt mode. I have no idea how to locate the file I want. I tried typing in many varieties of the following: CD"C:\WINDOWS\system32"
RMDIR splm /s

but every time I get a reply saying that ...is not recognized as an internal or external command... OR a reply saying that the system cannot find the path specified.

Can anyone help please?

[momneedshelp]

Just a quick thanks to dancoppock - My son picked up this runtime error 21 on facebook, I thought the error was related to McAfee since it wasn't working. Spent way too long working with them without results. Thanks for sharing you knowledge and skill.

[kongkong]

JJJ999, djmellowfellow

You can try doing this...
Make sure you are on safemode with command prompt
type cd/
then cd %systemroot%\system32
then type RMDIR splm /S

[danjo11]

Thanks everyone for the help. The command and safe mode worked for the error boxes. But I still cannot access certain antivirus sites like symantec. what should i do?

Thanks,

Danny

[Shark01]

danjo11

The virus changed some settings in the host files stored on your computer for Internet Explorer and just removing the virus does not fix that and therefore you still can not access those sites until the problem caused by the virus is fixed.

A few things to help you.

First, why the hell are you still using Internet Explorer? It is stupid, slow, and the least safe browser there is (well, actually, there are many with worse protection, but MOST viruses, malware, and other attacks specifically go for IE if any internet browser, so overall, it is the worst). Use Firefox. Better, faster, safer.

(BTW, When I saw people saying this virus was stopping them from accessing said antivirus sites, I tried them and they all loaded for me, but again, I use Firefox. I then thought "Maybe these are some stupid IE users", so I tried IE, and sure enough, those sites didn't work.)

Secondly, use Spybot Search & Destroy. It will fix things so IE can access those sites again. If you don't have Spybot, it is freeware, go get it. Update and check for errors, it will fix things. Also use the Immunization feature to better protect your computer from malware and other problems.

[djmellowfellow]

Thank you Kongkong. I tried it as you suggested. When I typed in the RMDIR bit I was asked to confirm with a Y or N. I typed Y and nothing seemed to happen except a new line came up saying C:\WINDOWS\system32>

I tried it again and this time it said "The system cannot find the file specified". However, when I restarted the computer in normal mode the error boxes are no longer coming up so I think this may have fixed it! Yippee!

There are still some files on the computer according to Hijackthis - d'yu think I can safely delete these? I'll be keeping a close eye on this over the next few days. Thanks again - How did you work out how to do it?

[NACW]

In my case the folder and files were Attrib +H and +S. This will hide the files and set them to SYSTEM FILE status. System files can not be deleted. cd c:\windows\system32\splm then type attrib -h -s *.*
this will allow you to see the files and delete them. My problem is that
the trojan blocked virus websites in IE and Firefox. I can not get to bitdefender.com for example ... Any Ideas????

[Shark01]

NACW

At one point this was blocking sites in IE for me. Before I completely removed the virus, I was able to (temporarily (then I did this again after removing the virus)) fix this and get the sites back in IE by using Spybot Search & Destroy. Just do a Check for Problems scan and let it fix things. (This never affected Firefox and blocked sites in Firefox for me, but Spybot also checks for Firefox problems and stuff as well as IE).

Also, you can use Spybot to Immunize your system from many things to better protect yourself from more malware (but update and immunize often).

[djmellowfellow]

Some people say that if you disable system restore it removes one of the dodgey files. Then you can get the rest in safe mode with Hijackthis, MSCONFIG and REGEDIT. (see the forum at http://www.fixya.com/support/t886930...rror_21_xp_sp2)

I'm worried about disabling System Restore in case I do something wrong. But has system resore failed to work for most people anyway?

Does anyone know if this virus is dangerous?

[NACW]

Thought about it for a while ..... HOSTS file could be redirected to 127.0.0.1 or even 0.0.0.0 ... that is exactly what it does. It redirects any request for most antivirus web sites including bitdefender and trend micro.
THe two most needed for because of the ability to remove the virus after scan (FREE)
Search for "Host"
Edit in notepad to remove any entries like these below
( if you have spybot installed pay attention to the 127.0.0.1 they list
sites that have been found to have viruses hosted)

0.0.0.0 trendmicro.com
0.0.0.0 www.trendmicro.com
#
0.0.0.0 norton.com
0.0.0.0 www.norton.com
#

[Shark01]

NACW, again, Spybot does all of that for you.

So, for people that don't want to do everything by hand, use Spybot.

[NACW]

I tried spybot to see what it would find. It did see and list the entry for
the web site redirect. The only problem was it only saw and removed the
first line which was the IE. www.bitdefender.com the next line was bitdefender.com. spybot decided to ignore the second entry in the host file.

I never used spybot untill today so I might have missed a setting. It asked me if I wanted to fix all checkmarked items I said yes...

>>> Try to Learn somthing new everyday <<<