You're welcome.       Sign up (learn about it) | Sign in (lost password?)

Wizard27 Profile
Live feed
Miscellaneous info

Registered: 10-2006
Posts: 122
Karma: 0 (+0/-0)
reply | quote
How to remove the N-Case Spyware

What is N-Case?
Ncase is a Comparison Alternative Shopping Engine developed by 180Solutions. It appears to be installed via an ActiveX drive-by download or bundled with several file sharing programs and a few others.

It will cause pop-up advertisements, can add shortcut items to the Startup or Desktop, and update itself.

There are a couple variants of Ncase, the normal one as well as at least one installed by an Active X drive-by download.

How do I Remove NCase?

1) Because several files may be in use currently when NCase has infected your system, you should first start Windows in Safe Mode, generally by pressing F8 when the computer restarts and choosing Safe Mode for the list of choices.

2) Remove the Startup Entry in the Registry

Click on Start, Run, Type REGEDIT and Click OK
Click the pluses(+) next to the following items
+ Software
+ Microsoft
+ Windows
+ CurrentVersion
+ Run

Right-Click on the file MSBB and click DELETE

Check for any randomly named entries pointing to an EXE file of the same name in the Windows directory
(this can be part of the NCASE infection as well)

Click the pluses(+) next to the following items
+ Software
+ Microsoft
+ Windows
+ CurrentVersion
+ Uninstall

Right-click and Delete the following folders

Click the pluses(+) next to the following items
+ HKEY_Current_User
+ Software

Right-click and Delete the folder called 180solutions

3) Delete the NCASE folder and/or the MSBB.exe file

Open My Computer, Drive C, Program Files

Right-click on the NCASE folder (if it exists) and Delete it, you may also find a 180Solutions folder, delete this as well.

Look for and Delete MSBB.EXE in the System or System32 directory under Windows

4) Remove the Active X Control (if present)

Open My Computer, Drive C, Windows, Downloaded Program Files folder

Right-click on the nCaseInstaller Class entry (if present) and click Delete
Close back out to the Desktop

5) Reboot the computer in Normal Mode and test (ncase should be gone)


16/11/06, 22:36 Link to this Post Send an Email to this person   Send a PM to this person

Add A Reply

You are not logged in (login)
--> The Runboard Web-Ring <--
Previous | Home | Join | Random | Next