Steps To Fix Runtime Error 21 Caused By Ncsjap32.exe

A runtime error generally occurs when an application is unable to locate an important file that it requires to complete a function. Most runtime errors are caused by malware infections.

In this article, we will discuss runtime error 21, which is caused by a malware process – ncsjapi32.exe and its solution.

What is ncsjapi32.exe?

The Ncsjapi32.exe file is a trojan that is known to be associated with the following threats:

  • VirTool:Win32/DelfInject.gen!AC [Microsoft]
  • VirTool:Win32/Delfsnif.gen [Microsoft]
  • BackDoor-AWQ.b [McAfee]
  • Generic.dx [McAfee]
  • Troj/Agent-HIP [Sophos]
  • Troj/Buzus-W [Sophos]
  • TROJ_AGENT.AFBG [Trend Micro]
  • TROJ_AGENT.ALKB [Trend Micro]
  • Trojan.Buzus!sd6 [PC Tools]
  • Trojan.Win32.Buzus.pzs [Kaspersky Lab]
  • Trojan.Win32.Buzus.qff [Kaspersky Lab]
  • Trojan.Win32.Buzus.rep [Kaspersky Lab]
  • W32.Koobface.B [Symantec]
  • Win32.SuspectCrc [Ikarus]

One popular source through which the ncsjapi32.exe virus has spread is Facebook, which is a popular social networking website. Users have reported being infected by the ncsjapi32.exe virus after they click on a link received in their Facebook account.

Error Message

You may encounter the following error message if your computer is infected with the ncsjapi32.exe virus:

“Runtime Error 21 at 025149D2”

When you click OK in the error message box, you may get another error message, stating “PERSONAL SETTINGS – C:\windows\system32\splm\ncsjapi32.exe.” Also, all your desktop icons may temporarily disappear and the runtime error 21 dialog box may reappear on your screen.

How to fix runtime error 21

To fix the runtime 21 error, you need to delete all the files that are associated with this malware process.

To achieve this, perform either of the following methods.

Method 1: Manually Remove the Facebook Virus

The facebook virus is known to install the following files in C:\Windows\System32\splm folder:

  • ncsjapi32.exe
  • kbdsapi.dll
  • lmfunit32.dll

To remove the facebook virus manually, you need to delete all the files associated with the virus and remove registry entries associated with the ncsjapi32.exe process.

Perform the following steps to remove the files manually:

  1. Restart your computer in the Safe mode
  2. Click the Start menu and select Run.
  3. In the Open box, type cmd and click OK.
  4. In the Command Prompt window, type CD "C:\WINDOWS\system32" and press Enter.
  5. Next, type RMDIR splm /S and press Enter to delete the splm folder.
  6. Restart your computer in Normal mode.

Note: The following steps require you to edit the registry. Proceed only if you are comfortable in working with the registry. Also, make registry back ups before performing any changes to the registry. This allows you to restore the registry in case a complication occurs. You can make registry back ups either manually by using the Registry Editor tool in Windows or automatically by using a reliable registry cleaning software, such as RegServe.

To remove entries related to the ncsjapi32.exe file, perform the following:

  1. Go to Start and click the Run command.
  2. In the Open box, type regedit to open the Registry Editor window.
  3. Next, click Find.
  4. In the Find What box, type ncsjapi32 and delete the entries that are displayed in the search results.
  5. Press F3 to search again and repeat until all occurrences of ncjapi32.exe file are deleted from the registry.
  6. Finally, restart your computer.

Method 2: Remove Using an Antivirus Tool

The manual removal process is a bit tedious and time consuming, and the chances of complete virus removal are quite low. At the same time, there are also several risks involved. For instance, you may delete an essential system file or registry entry that may create more problems on your computer.

This is the reason why, it is best to use a robust protective tool, such as STOPzilla Antivirus, to scan, detect and completely remove this malware process from your computer. For effective cleaning, it is best that you perform the virus scan by starting your computer in Safe mode.

It is always good to follow up a virus scan with an antispyware scan. This is because an infected computer opens up to several other threats and the chances of spyware and adware installing on it are quite high. You can use a good antispyware, such as Spyware Cease to perform a thorough scan of your computer.

It is recommended that you run virus and spyware scans at least two times to ensure that no malicious data is left behind on the PC.