|
n-Case |
  
|
|
n-Case |
|
Ncase is a Comparison Alternative Shopping Engine developed by 180Solutions. It appears to be installed via an ActiveX drive-by download or bundled with several file sharing programs and a few others. It will cause pop-up advertisements, can add shortcut items to the Startup or Desktop, and update itself.
There are a couple variants of Ncase, the normal one as well as at least one installed by an Active X drive-by download.
How toRemove NCase
1) Because several files may be in use currently when NCase has infected your system, you should first start Windows in Safe Mode.
2) Remove the Startup Entry in the Registry
| • | Click on Start, Run, Type REGEDIT and Click OK |
| • | Click the pluses(+) next to the following items |
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
| • | Right-Click on the file MSBB and click DELETE |
| • | Check for any randomly named entries pointing to an EXE file of the same name in the Windows directory |
(this can be part of the NCASE infection as well)
| • | Click the pluses(+) next to the following items |
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
| • | Right-click and Delete the following folders |
nCase
msbb
| • | Click the pluses(+) next to the following items |
HKEY_Current_User\Software
| • | Right-click and Delete the folder called 180solutions |
3) Delete the NCASE folder and/or the MSBB.exe file
| • | Open My Computer, Drive C, Program Files |
| • | Right-click on the NCASE folder (if it exists) and Delete it, you may also find a 180Solutions folder, delete this as well. |
| • | Look for and Delete MSBB.EXE in the System or System32 directory under Windows |
4) Remove the Active X Control (if present)
| • | Open My Computer, Drive C, Windows, Downloaded Program Files folder |
| • | Right-click on the nCaseInstaller Class entry (if present) and click Delete |
| • | Close back out to the Desktop |
5) Reboot the computer in Normal Mode and test (ncase should be gone)
More info:
http://www.pchell.com/support/ncase.shtml
 |
 |
 |
Page url:
http://www.tje.net/PCSupport/index.html?n_case.htm
Page content was last updated: 10/7/2008
|
|
