I've managed to get a virus on my PC from a facebook link which was sent to me as a genuine-sounding message from a friend.
Every time I log on two boxes pop up reading 'Runtime error 21 at xxxxxxxx'. The x's are replaced with a code that changes every time. When both boxes are up, I am unable to do anything. If I close both boxes then it refreshes and two new boxes appear. The only way to keep using the computer is to close one box and minimise the other.
Some other forums are suggesting things to deal with this startup virus but I have not been able to remove it and would be very very grateful of some help from somone who knows what they're doing please.
I followed the advice of someone called Dancoppock on the Tech Support Guy Forum.
First I used Autoruns to search and disable the problem file (ncsjapi32.exe). Then I rebooted the computer in Safe Mode with Command Prompt. Then I typed in:
cd/ cd %systemroot%\system32 RMDIR splm /S
as advised by various people. I was prompted with the following:
Are you sure <Y/N>?
And I typed:
Then up came:
I rebooted and the pop up boxes don't come up anymore. But the files are still there. The following forum suggests some ways to delete all the files but I'm worried about turing off system restore in case I do some damage to the PC:
1. Turn off system restore 2. Clean all prefetch data and temp files. 3. Scan system, using your prefered, upto date antivirus. 4. Remove any unknown programs (Google if unsure), from add remove window. 5. Download SpywareBlaster and Ccleaner. 6. Turn system restore back on.
The list does go on, but these are the main points. If you Google, you'll see what I mean.
I Googled "facebook virus" and came up with alot. Nothing that explains your problem, but alot to look at anyway. As for "prefetch data" go to start, run, type in prefetch and all that data that is displayed is what your looking for. Another way is to download Ccleaner, click here, install, go to the advanced tab, and put a tick in "old prefetch data" and run the program.
I followed your advice above and the virus seems to have allmost completely dissapered. The only thing it's left behind is an entry in MSCONFIG startup (reading <<ncsjapi32>>) which I've unchecked but won't go away.
However I've now got another problem as McAfee VirusScan Plus has stopped working properly. It says I need to reinstall VirusScan Plus but I've tried and for some reason I am unable to connect to the McAfee website through my PC. The rest of the internet seems to be working. It doesn't make sense!
If you've any ideas on what's not working then please can you help me? THanks.
This thread is now locked and can not be replied to.