Runtime error 21 at... (Facebook Virus)

  djmellowfellow 19:35 11 Aug 2008

I've managed to get a virus on my PC from a facebook link which was sent to me as a genuine-sounding message from a friend.

Every time I log on two boxes pop up reading 'Runtime error 21 at xxxxxxxx'. The x's are replaced with a code that changes every time. When both boxes are up, I am unable to do anything. If I close both boxes then it refreshes and two new boxes appear. The only way to keep using the computer is to close one box and minimise the other.

Some other forums are suggesting things to deal with this startup virus but I have not been able to remove it and would be very very grateful of some help from somone who knows what they're doing please.

Thanks. DJ

  djmellowfellow 10:56 12 Aug 2008

Hey, I'd be surprised if no one else has got this same problem. Please if you recognise the virus can you give me some advise on how to remove it? Thanks.

  SB23 11:09 12 Aug 2008

I'm a Facebook user, but I've not come across this.
What programs have you used to try and remove the problem?

  djmellowfellow 11:29 12 Aug 2008

I followed the advice of someone called Dancoppock on the Tech Support Guy Forum.

First I used Autoruns to search and disable the problem file (ncsjapi32.exe).
Then I rebooted the computer in Safe Mode with Command Prompt. Then I typed in:

cd %systemroot%\system32
RMDIR splm /S

as advised by various people. I was prompted with the following:

Are you sure <Y/N>?

And I typed:


Then up came:


I rebooted and the pop up boxes don't come up anymore. But the files are still there. The following forum suggests some ways to delete all the files but I'm worried about turing off system restore in case I do some damage to the PC:

click here

Any thoughts?

  SB23 11:49 12 Aug 2008

All I can really find is the usual info.

1. Turn off system restore
2. Clean all prefetch data and temp files.
3. Scan system, using your prefered, upto date antivirus.
4. Remove any unknown programs (Google if unsure), from add remove window.
5. Download SpywareBlaster and Ccleaner.
6. Turn system restore back on.

The list does go on, but these are the main points.
If you Google, you'll see what I mean.

  djmellowfellow 16:24 12 Aug 2008

Thanks SB23.
Couple of things:
- What's prefetch data and how do I clear it?
- WHat did you search in google to get this?

THanks again.

  SB23 19:00 12 Aug 2008

I Googled "facebook virus" and came up with alot. Nothing that explains your problem, but alot to look at anyway.
As for "prefetch data" go to start, run, type in prefetch and all that data that is displayed is what your looking for. Another way is to download Ccleaner, click here, install, go to the advanced tab, and put a tick in "old prefetch data" and run the program.


  djmellowfellow 12:11 13 Aug 2008

Thanks Steve. That's great. I'll let you know how it goes. DJ

  djmellowfellow 10:46 03 Sep 2008


I followed your advice above and the virus seems to have allmost completely dissapered. The only thing it's left behind is an entry in MSCONFIG startup (reading <<ncsjapi32>>) which I've unchecked but won't go away.

However I've now got another problem as McAfee VirusScan Plus has stopped working properly. It says I need to reinstall VirusScan Plus but I've tried and for some reason I am unable to connect to the McAfee website through my PC. The rest of the internet seems to be working. It doesn't make sense!

If you've any ideas on what's not working then please can you help me? THanks.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

AMD Radeon Adrenalin release date, new features, compatible graphics cards

Turn a photo into 16-bit pixel art

iMac Pro release date, UK price & specs

Comment suivre le parcours du père Noël ?