[!cweb5!]

I think I acquired a virus from facebook. I clicked on a link posted on my wall and it redirected me to a Web site with an animation. I left the site and two dialogue boxes popped up, both reading "Runtime Error 21 at 00DC49D2." The 00...... changes. When I click "ok," another dialogue box flashes in the top left corner. It reads, PERSONAL SETTINGS - C:\ Windows\system32\splm\ncsjapi32.exe. All of the icons temporarily disappear and the runtime error dialogue boxes reappear. I appreciate any help. Thanks.

[Blue Zee]

Start in Safe Mode and try System Restore.

You can also try running your anti-virus and anti-malware scanners in Safe Mode.

[mabuza]

Not that I am any help, still trying to deal with it myself because I just got the exact same error this morning. It's driving me crazy. Well let me play with it for a little while

[dancoppock]

Hi,

I also noticed this problem this morning. The virus installs several startup entries, pretending to be 'IntelliMouse' etc; you can check this by using a tool like Autoruns. I couldn't find a way of uninstalling it with Windows running - it even runs in Safe mode; it isn't picked up by virus scanners; and it disables you from being able to view hidden files and folders.
It seems to install several programs to the C:\WINDOWS\system32\splm folder: ncsjapi32.exe, kbdsapi.dll, lmfunit32.dll

I managed to get rid of it by booting windows into "Safe Mode + Command Prompt" - and then when you've got a command prompt running type:
CD "C:\WINDOWS\system32"
RMDIR splm /S

[Took the Elder]

Just quickly wanted to say cheers to Mr. dancoppock, your solution appears to have worked

hope no-one minds, but i made a group on facebook about this whole thing and put a link to this page.......someone'll tell me if'n i done wrong, right?

[JJJ999]

I have the exact same virus, I've tried going to the safe mode + command prompt and got it to the C:\WINDOWS\system32 but when I type in the RMDIR splm /S it asks if I want to make the change and I said Y and then it says that the file can't be found. Am I doing something wrong?

[TAliyev]

I have the same problem. RMDIR splm cannot find directory.... Also it seems that computer no longer can browse anti virus related web sites like McAfee, Norton, TrendMicro.. All those sites seem to be inaccesible.... My McAfee did not detect it, and when I tried to update it, system cannot find their web server....

[JJJ999]

I can access the virus servers, but the virus also hasn't done any apparent damage yet as spybot has been blocking it all day!

[TAliyev]

Well, I cannot find this damn thing. In safe mode it is invisible..... Windows registry no longer shows this 'Intelli mouse' entry, before I could not get rid of it... now it is gone by itself... Still cannot see antivirus web sites. By the way, I did do system restore and now I do not have those error 21 pop-ups, but this virus is still here...... I wonder what is going to happen next....

[!cweb5!]

In Safe Mode + command Prompt I typed in C:\WINDOWS\system.....
It asks me if I'm sure and I type "Y"... then

splm,\kbdsapi.dll - Access is denied.
splm\lmfunit32.dll - Access is denied ... shows up.

Also, when I try system restore, it won't let me hit the next button to confirm. The error 21 at .... pops up again.

Any suggestions? Thanks.

[kittyfluff]

I picked this up yesterday and have been trying to get rid of it since. I've tried scanning in Safe Mode with my antivirus and malware software. It picked up some of the components installed (imfunit32.dll, kbdsapi.dll) and removed them, but couldn't remove ncsjapi32.exe

I tried System Restore and this failed to work.

I tried going into Safe Mode + Command Prompt and typing in
C:\WINDOWS\system32
RMDIR splm /S

but it won't recognise the command or locate the file.

I would love to just reformat and reinstall, but my XP disk is stupidly back in the UK and I am currently in Ireland.

Anything else I can try?

[Took the Elder]

Sorry that dancoppock's solution doesn't seem to be working for everyone else!

However, if it has worked for anyone, but the show hidden files and folders option is still not working, i have found a possible solution at:

http://www.technize.com/2007/05/13/show-hidden-files-and-folders-not-working/

the second option appears to have worked for me.....

[dancoppock]

Sorry to hear that this has been causing people so many problems.

Before I booted into Safe Mode + Command Prompt, while I was logged into Windows normally I ran Autoruns [http://technet.microsoft.com/en-us/s...bb963902.aspx] from a USB drive, clicked on the 'Everything' tab, and searched for and disabled all entries called 'ncsjapi32.exe'.

I didn't think this would be a necessary step but if you can download and run Autoruns it will allow you to edit the registry items which start ncsjapi32.exe.

You should then be able to boot into Safe Mode + Command Prompt and remove the offending items.

Hope that helps.

[Shark01]

Long post, important stuff in bold.

Got infected yesterday when my bro clicked a link posted on his Facebook wall.

A friend of ours account apparently got hacked, or someone got their password, and was being used to post on a lot of the walls of people on their friends list, again using their account and making people more willing to click. A bunch of their friends got infected.

We got the "Error 21" messages popping up (we got two. Learned if we leave them, we can't do anything, close both and computer freaks out and we can't do anything, close only ONE and leave ONE open and we could still do everything normally.) They are gone now! But those messages were the only prob we were seeing except for the also new crashing of a WMP300N.exe (used for our wireless net card) when logging off (which I got fixed).

My bro looked for "Error 21" help and found it is "Something with the registry" and DLed a few "Guarinteed" fixing programs that did not help.

I searched and searched for "Error 21" with no help, then I looked at currecntly running things with task manager and startup entreis with CCleaner and Windows Defender. Found a "ncsjapi32.exe" (saying it was "Intelli Mouse 2.08" or something) and searched google, this page was the ONE result.

I read about not being able to see hidden files, update antivirus, or view antivirus sites. I checked these. I could use and view hidden files, update my antivirs, and view mentioned antivirus sites (I use Firefox). I then thought "Maybe they meant Internet Explorere", and sure enough said sites wouldn't work there.

I didn't want to jump right into using safe mode and command promt before looking at some other stuff.

I removed and deleted the startup entries using multiple programs, but they always made new ones. I then updated Spybot and scanned, it found the program and some of the changes it made, fixed them! Stoped the virus from running and the startup entry for only a short time (then it made new ones) but did fix the antivirus sites in IE.

Eventually I did what dancoppock said with safe mode and command promt. Typed exactly what he said, only took a few seconds, confirmed the action, rebooted, no more Error 21 messages! No more ncsjapi32.exe or the other dlls and crap! Everything runs perfect! Just removed the startup entries to clean the registry and everything is perfect again!


Thanks for helping me fix the "Facebook Virus" dancoppock! You Rock!


I am now sending infected friends this way and will be telling me friend who's account was sending links to this virus to send her friends this way.


Also, I want to point out that I think Facebook might be catching onto this, at least with my friend's account. All the posts that her account made (that she didn't delte after finding out it was a link to a virus) Facebook apparently came through and deleted themselves. So maybe Facebook will help their users by stoping further spreading of this.

[JJJ999]

I ran the autoruns and got rid of the ncsjapi43's and then went back and tried to do the Safe Mode + command prompt again. When I bring it up it says C:\mycomputer/mydocuments and then I type in the C:\system 32 then on the next line the C: stays at my computer and I type in the RMDIR splm /S and do the Y and it says the file can't be found. Should it be changing to C:\system 32 before I type in the RMDIR... ? Could this be the problem, and if so, how do I change this? Thanks, sorry don't know much!