Wizard27
Registered: 10-2006
Posts: 122
Karma: 0 (+0/-0)
|
|
reply | quote
|
|
How to remove the N-Case Spyware
What is N-Case?
Ncase is a Comparison Alternative Shopping Engine developed by 180Solutions. It appears to be installed via an ActiveX drive-by download or bundled with several file sharing programs and a few others.
It will cause pop-up advertisements, can add shortcut items to the Startup or Desktop, and update itself.
There are a couple variants of Ncase, the normal one as well as at least one installed by an Active X drive-by download.
How do I Remove NCase?
1) Because several files may be in use currently when NCase has infected your system, you should first start Windows in Safe Mode, generally by pressing F8 when the computer restarts and choosing Safe Mode for the list of choices.
2) Remove the Startup Entry in the Registry
Click on Start, Run, Type REGEDIT and Click OK
Click the pluses(+) next to the following items
+ HKEY_LOCAL_MACHINE
+ Software
+ Microsoft
+ Windows
+ CurrentVersion
+ Run
Right-Click on the file MSBB and click DELETE
Check for any randomly named entries pointing to an EXE file of the same name in the Windows directory
(this can be part of the NCASE infection as well)
Click the pluses(+) next to the following items
+ HKEY_LOCAL_MACHINE
+ Software
+ Microsoft
+ Windows
+ CurrentVersion
+ Uninstall
Right-click and Delete the following folders
nCase
msbb
Click the pluses(+) next to the following items
+ HKEY_Current_User
+ Software
Right-click and Delete the folder called 180solutions
3) Delete the NCASE folder and/or the MSBB.exe file
Open My Computer, Drive C, Program Files
Right-click on the NCASE folder (if it exists) and Delete it, you may also find a 180Solutions folder, delete this as well.
Look for and Delete MSBB.EXE in the System or System32 directory under Windows
4) Remove the Active X Control (if present)
Open My Computer, Drive C, Windows, Downloaded Program Files folder
Right-click on the nCaseInstaller Class entry (if present) and click Delete
Close back out to the Desktop
5) Reboot the computer in Normal Mode and test (ncase should be gone)
|
|
16/11/06, 22:36
|
|
