n-CASE

Overview

n-CASE generates a log of your surfing activity, including the web pages you visit and in which order you visit them. The log is uploaded to the n-Case server and is used for marketing purpose and to open advertisements that fit you preferences.

From the vendor: The follow section describes what information n-CASE collects and how it operates:

Personal Information When you register with one of 180Solutions' distribution partners, you may be asked to provide certain personal information about yourself and your interests. In some cases, non-personally identifiable information about you may be passed to us by the partner. This may include, but is not limited to: your age, sex, geographic region and interests. Occasionally, 180Solutions may also display questions to you, inviting you to answer. Any answers you supply are covered by this privacy policy. 180Solutions does not collect or store your name, address, email address, or any other data defined as "personally identifiable information". 180Solutions uses this information to learn more about its audience. 180Solutions also uses this information to provide you with content and information most likely to be relevant to you. 180Solutions' n-CASE product also puts a "cookie" on your machine so that our technology can recognize you and display appropriate advertisements.

Tracking When n-CASE is actively running on your computer, the software generates logs of your surfing activity, including web pages you have visited and the order in which you visited these pages. These logs are then uploaded to 180Solutions' secure servers. We use these logs for market research purposes and to provide you with offers and content specifically targeted to your interests and habits. 180Solutions stores these logs on our servers, for our use. While complete URLs are collected by the software and uploaded to our servers, any personally identifiable information in those URLs is stripped away before storage in our database. We may aggregate information from these surfing logs and share the data with third parties. However, this aggregate data will never identify you individually. Source

n-CASE connects to 66.35.229.241 and 216.74.57.198

nCase has been promoted by activeX pop-up windows and bundled with a large number of products, such as Kazaa, Grokster, Kazaa Download Accelerator, 2 Find MP3, Grand Canyon Screensaver, etc.

n-CASE includes an alert component, that will notify you with a pop-up window if parts of the n-CASE software has been uninstalled or disabled. The alert component runs at startup and uses random file names and registry keys which makes it harder to detect for anti-spyware software. The alert executable is located in %WinDir%. The alert pop-up will display the following:

The system has detected that a third-party application has removed n-CASE, possibly without your consent. This may cause some programs not to run as expected. Please choose an option below

-Re-install n-CASE so that your programs will run as expected. Requires internet connectivity.
-Leave n-CASE un-installed, and clean up any n-CASE files or settings that remain.
-Remind me later.

Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).

TrendMicro reports that TROJ_DELF.DS have installed n-CASE.

Vendor

180Solutions

Classification

Adware

Privacy policy

2003-11-27

Detection

Bazooka Adware and Spyware Scanner detects n-CASE. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Files

msbb.exe, ncmyb.dll, msbb.dll, msbb1.dll, KRY.exe, PWG.exe

If you have any of the files related to n-CASE on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the n-CASE software. Thank you very much for your time!

Log references

Log 83

Detection

Bazooka Adware and Spyware Scanner detects n-CASE. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall notice for n-CASE

Notice that removing n-CASE may cause the program that bundled it to not function as intended.

Uninstall procedure

Uninstall n-CASE from "Add/Remove Programs" in the Windows® Control Panel. Look for "Interstitial Ad Delivery by n-CASE" and "PAD Lookups by n-CASE". The vendor also offer uninstall instructions. If the uninstall fails, please contact the vendor for support.

Uninstall n-CASE with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling n-CASE. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove n-CASE manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If n-CASE remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
2. Browse to the key:
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
3. In the right pane, delete the values called 'msbb', 'KRY' and 'PWG', if they exists.
4. In the right pane, look for value that looks random, for example 'ROQW'. Delete this value.
5. Exit the registry editor.
6. Restart your computer.
7. Start Windows Explorer and delete:
   %ProgramsDir%\n-Case\
   %ProgramsDir%\nCase\
   %SystemDir%\msbb.exe
   %SystemDir%\msbb.dll
   %SystemDir%\msbb1.dll
   %WinDir%\ncmyb.dll
   %WinDir%\KRY.exe
   %WinDir%\PWG.exe
   %WinDir%\msbbi.exe
   Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).
   Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
   Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.
   

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for n-CASE's vendor

In order to provide correct, accurate and updated information about n-CASE I encourage the vendor to contact me if any part of this write-up needs a revision.