runtime error 21 at xxxxxxx (xxxxxx - location may not matter)
read and understand this entire post before doing anything.
Unless you have been creating restore points for every single change you ever made to your system, or unless you made a restore point just before this happened (see facebook below), do not do a system restore. System restore is for severe issues as a last resort before you decide to wipe you system. Even then, after a system restore, its really unclear as to where you system is in life but its enough to recover some data and sometimes is all thats needed. But I am recommending against system restore unless its a last resort and you absolutely know your system inside and out and have created restore points religiously. So, no system restore. Just say no.
So far that I know, this is not a fatal virus or fatal system problem, so you have time to get a friend to help you. You may be in better shape than you think. At the bottom I explain that the error could be caused because the actual virus part may already be deleted or was never installed which is what may cause the runtime errors. Dont panic.
It seems to be a botched attempt at something that either works on some PC's and causes this error on others or just doesn't work at all, not enough info. This doesnt get picked up by Norton because it is probably not a real virus-yet.
Leave the error messages alone while you work. dont click OK to either of them.
If your system freezes, and you can, click "OK" on only 1 of the error messages but not both (which one do I click? they are identical. Its a guessing game, try the first one or the 2nd one that pops up but remember which).
If you are already frozen (so you think), press the keyboard combo cntl-alt-delete to bring up the task manager. look for 2 processes with the same name (run32? - I cant remember) that you think are the error messages. kill one of them and your system should un-freeze.
Think back. Do you have a facebook account that you clicked on something on your "wall" from someone you dont know?
I'm dubbing this the "Facebook virus" for lack of anything better for the moment.
warning, from this point, you go at your own risk. my advice is for those with knowledge of the registry. Its not that hard to work in the registry, but changes are permanent and immediate.
backup the entire registry first!!!
backup the entire registry first!!!
backup the entire registry first!!!
(point made)
Look for this:
It seems to install several programs to the C:\WINDOWS\system32\splm folder: ncsjapi32.exe, kbdsapi.dll, lmfunit32.dll
I've seen others talk about a similar folder in the system32 folder as well (sp??)
search for this in your registry: ncsjapi32.exe or look in these keys
There are 3 or 4 locations. It pretends to be logitech 2.0B
HKCU,software,microsoft,windows,current version folder
HKCU,software,microsoft,windows,current version, run folder
HKLM,software,microsoft,windows,current version, run and run once folders
do not delete the entire folder. only the logitech entries within.
If you dont have a logitech device installed, typically a mouse or camera, then there shouldn't be any logitech entries in these registry folders (logitech 2.0B, logitechvideorepair etc)
something else I remembered. The entry may start with an asterisk(*) -- *logitech...
again you should have some registry knowledge or ask a friend to help you.
also look in HKLM, software,micorsoft,active setup, installed components - There is a lot of folders with just numbers or letters, then there are real folders in there. one of the named folders might say nscan or logitech. look in this folder to see if the data points to the same splm folder. if so, delete the nscan folder.
Delete the splm folder from windows\system32.
If you dont have Spybot S&D installed, its located here and is free:
http://www.safer-networking.org/en/home/index.html
A good system has spybot, adaware, windows defender and superantispyware and an antivirus program. (I'm not going to argue, I like norton for home use.) As well as a router even if you have only 1 pc at home. Zone alarm can be tricky for some so windows firewall can suffice. But I'm getting off track here.
If you have Spybot S&D installed, start the tea-timer to automatically protect those 3 locations in your registry before you make changes. Then delete the value entries (what is a value? -registry knowledge needed - in my scenario its the part that says *logitech - but again ask a friend to help if you dont know the components of the registry) then Tea-timer will popup and say "value deleted," click allow change. Then if the virus program is still running, it tries to put the entries back in and tea-timer will say "value added", click "deny and remember". Tea-timer will keep the rogue program from being able to add the startup entry back in.
then when all registry entries have been changed to removing the virus startup entry, reboot.
(remember, in the registry, for all but one, you are not deleting a folder but logitech entries (values). one of the registry locations, nscan folder, you are deleting the folder if the contents all point the already mentioned location. In windows explorer, you are deleting the splm folder. If there is no splm or similar folder found, then that part of the virus may already be gone and all that is left is the registry entry part, which is probably why it has an error, it cant find the files to run).
This above procedure worked for me but may not work for you and or may be different. Use this as a guide only to add to what others are saying.
NCADMIN
August 2008
howtomendit.com for free repair help, information and advice.
