n-case remove instructions, learn more about this adware and how to uninstall n-case in our removing and uninstaller guide
NCase is an adware application that looks for known URLs and keywords in URLs, and opens pop-up advertisements targeted at such sites. nCase also opens non-targeted pop-up adverts at arbitrary times when using Internet Explorer.
Ncase is a Comparison Alternative Shopping Engine developed by 180Solutions. It consists of a process, msbb.exe, that runs constantly with Windows and shows advertising. It will cause pop-up advertisements, can add shortcut items to the Startup or Desktop, and update itself.
NCase generates a log of your surfing activity, including the web pages you visit and in which order you visit them. The log is uploaded to the N-CASE server and is used for marketing purpose and to open advertisements that fit you preferences.
It appears to be installed via an ActiveX drive-by download or bundled with several file sharing programs and a few others. Bundled with a large range of applications, particularly file-sharing programs. nCase are known to send e-mail to software authors asking them to include the nCase bundle.
It will cause pop-up advertisements, can add shortcut items to the Startup or Desktop, and update itself. Ncase is aware of the FlashTrack parasite and will disable it if it is running, to stop it showing competing adverts. Some versions also seem to connect to the Gator web servers occasionally, for unknown reasons.
Ncase presents some rather serious privacy violations. When passing information back to its servers, the URL or keyword is passed with a unique identifier to nCase's controlling server bis.180solutions.com when a targeted advert is shown, allowing web usage to be tracked across sites.
N-CASE includes an alert component, that will notify you with a pop-up window if parts of the N-CASE software has been uninstalled or disabled. The alert component runs at startup and uses random file names and registry keys which makes it harder to detect for anti-spyware software. The alert executable is located in %WinDir%. The alert pop-up will display the following:
The system has detected that a third-party application has removed N-CASE , possibly without your consent. This may cause some programs not to run as expected. Please choose an option below
-Re-install N-CASE so that your programs will run as expected. Requires internet connectivity.
-Leave N-CASE un-installed, and clean up any N-CASE files or settings that remain.
-Remind me later.
Newer versions of the software also seem to try to read an e-mail address, real name and ZIP code to associate with the unique identifier, from applications' data in the registry:
Outlook Express mail accounts
Outlook user info
AOL Instant Messenger accounts
Windows location
RealPlayer location
Windows Fax headers
eFax.com headers
Acrobat user info
Netscape user info
MS Comic Chat registration
GameSpy registration
NetFerret registration
n-case behavior
- Shows commercial adverts
- Connects itself to the internet
- Hides from the user
- Stays resident in background
n-case remove and uninstalling Introduction
Kill processes :
msbb.exe, saap.exe, saie.exe, sain.exe, sais.exe, salm.exe, zango.exe, 180ax.exe, 180adsolution.exe
Delete registry values:
HKEY_CURRENT_USER\Software\msbb
HKEY_CURRENT_USER\Software\saap
HKEY_CURRENT_USER\Software\saie
HKEY_CURRENT_USER\Software\sain
HKEY_CURRENT_USER\Software\sais
HKEY_CURRENT_USER\Software\salm
HKEY_CURRENT_USER\Software\zango
HKEY_CURRENT_USER\Software0solutions
HKEY_LOCAL_MACHINE\SOFTWARE\msbb
HKEY_LOCAL_MACHINE\SOFTWARE\saap
HKEY_LOCAL_MACHINE\SOFTWARE\saie
HKEY_LOCAL_MACHINE\SOFTWARE\sain
HKEY_LOCAL_MACHINE\SOFTWARE\sais
HKEY_LOCAL_MACHINE\SOFTWARE\salm
HKEY_LOCAL_MACHINE\SOFTWARE\zango
HKEY_LOCAL_MACHINE\SOFTWARE0solutions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saie
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sais
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\salm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zango
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run0ax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run0adsolution
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ncase
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\zango
Unregister DLLs:
msbbhook.dll, ncmyb.dll, saaphook.dll, saiehook.dll, sainhook.dll, saishook.dll, salmhook.dll, zangohook.dll, 180axhook.dll, 180adsolutionhook.dll
Delete files:
msbb.exe, saap.exe, saie.exe, sain.exe, sais.exe, salm.exe, zango.exe, 180ax.exe, 180adsolution.exe, msbbhook.dll, ncmyb.dll, saaphook.dll, saiehook.dll, sainhook.dll, saishook.dll, salmhook.dll, zangohook.dll, 180axhook.dll, 180adsolutionhook.dll
Delete directories:
C:\Program Files\nCase
C:\Program Files\n-Case
C:\Program Files\MSBB
C:\Program Files0Solutions
C:\Program Files0 Search Assistant
Misc:
nCase usually doesn't install all the listed files and registry entries, but adds only few of them. Listed objects are associated with several widely spread nCase variants.
|