Anyone Ever Heard Of...

[Betty1]

The nCase parasite?

 

I keep manually removing it, but it keeps coming back to my system. Along with a couple of others. Now, as long as I stay on the AOL broswer I seem to be fine. But once I go to one of the MSN browsers forget it. I've come to the conclusion that I should stay off of the MSN browsers.

 

Anyways, any ideas on how to keep the nCase off my computer?

[TCH-Dick]

Note: Removing this adware component from the system will likely cause the program that installed it to not function as intended. The uninstaller generally identifies the programs that will not work after uninstallation.

Before you begin: The adware that we detect as Adware.Ncase is produced by 180Solutions, which provides removal instructions on their Web page at:

 

http://www.180solutions.com/Consumers/

 

You may want to follow their removal instructions first, and then follow the instructions below to make sure that all the elements have been removed.

 

1. Update the virus definitions.

2. Delete the value that was added to the registry. Restart the computer.

3. Run a full system scan and delete all the files detected as Adware.Ncase.

 

 

1. Updating the virus definitions

Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

 

* Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).

* Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

 

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

 

 

2. Deleting the value from the registry

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Note: This is done to make sure that all the keys are removed. They may not be there if the uninstaller removed them.

 

1. Click Start, and then click Run. (The Run dialog box appears.)

2. Type regedit

 

Then click OK. (The Registry Editor opens.)

 

3. Navigate to the key:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

4. In the right pane, delete the value:

 

"msbb"="[path]\msbb.exe"

 

5. Delete the following registry keys:

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nCASE

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb

* HKEY_CURRENT_USER\Software\180solutions

 

6. Exit the Registry Editor.

7. Restart the computer.

 

 

3. Scanning for and deleting the infected files

 

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."

2. Run a full system scan.

3. If any files are detected as infected with Adware.Ncase, click Delete.

[Betty1]

I think I got it off my system. I ran my spyware removal program, Ad-aware and it found like 50 different files all associated with nCase, Xupiter tool bar and some other spyware software. Deleted all that off and it seems to be running pretty good right now. In face...haven't had a pop-up yet since I did like 4 or 5 hours ago.

 

It was just so annoying. I was spending half my time on line closing pop-up windows.

Edited January 28, 2004 by Betty1

[DarqFlare]

Spybot works well too.

[TCH-Bruce]

And if you are using Spybot make sure you Immunize. And check the link for Spyware Blaster inside the Immunize form. The immunization and Spyware Blaster programs will prevent most of these trojans and worms.

[ThumpAZ]

One of the things to be aware of with Spybot is that there was a hacked version going around the Internet not too long ago that was actually viral. There is also one presenting itself as a Spyware removal tool, but is not... it is SpyBan, stay away from that one for sure.

Adaware is also a good tool, but it is not free.

Hijackthis is yet another good tool, but I would not recmmend it to any novice users. However, a LOT of online forums are dedicated to helping folks out when they post their HJT log.

 

To make sure you get the clean version, visit www.safer-networking.org or security.kolla.de <-- that one redirects to the safer-networking one.

[TCH-Bruce]

Adaware is also a good tool, but it is not free.

 

They do have an updated free version out now.

[Lianna]

Pest Patrol. Not free but worth every penny. I used to run the paid version of Ad-aware, but their updates were few and far between. I installed and ran Pest patrol right after running Ad-aware and the "pests found" list was VERY long.

[bellringr]

I use both AdAware and Spybot Search and Destroy. But be careful....the first time I did a search on Google for Spybot, one of the first links to it actually linked to a spyware download disguised as Spybot. Just be sure to download from the actual Spybot S&D page to be safe.

 

I do like AdAware, but as someone said, their updates are few and far between. They did help me clean up my registry after an awful Kazaa experience two or three years ago though. I've learned much since then. heh