Remove nCase

What is nCase ?

-case is a spyware software which silently generates logs of your surfing activity. The software also silently uploads these logs to the servers of 180Solutions's who are the developers of N-case.

nCase variants

nCase/msbb is the core executable.

nCase/Inst is an ActiveX drive-by installer control that loads nCase/msbb. This has been seen since around March 2003.

nCase/Alert is a randomly-named executable run at start up that checks that for nCase being removed. It then offers to reinstall the main program, or remove itself (this option does work, rather better than the 'official' uninstall in fact).

nCase behavior

Redirects Searches
Shows ads

nCase Removal Instructions:

There is an uninstall feature for nCase, but it is a bit of a bad joke. You have to go to Add/Remove Programs in the Control Panel, choose 'Insterstitial ad delivery by n-Case', click 'Remove', confirm you are connected to the internet and download the uninstaller EXE. (This only works if Active Scripting in Internet Explorer is set to 'Enable', not 'Disable' or 'Prompt'.)

Run the uninstaller (which will again ask for internet access) and then do the whole lot over again for the entry 'PAD lookups by n-Case'. And it still sometimes doesn't work, for unknown reasons.

To add injury to insult, this method does not remove the installer control, so if you had the nCase/Inst variant, any web page will be able to re-install nCase without any prompting.

You may find it easier to remove by hand.

Manual removal
Open the registry (click 'Start', choose 'Run' and enter 'regedit'), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, right-click the entry 'msbb' inside it, and click 'Delete'.

To delete nCase/Alert, also check for a randomly-named entry three or more letters long, pointing to a .EXE of the same name in the Windows folder. Delete this entry and the file it points to. Alternatively, wait for the next restart and it should prompt to you reinstall or remove itself.

Restart the computer and you should be able to delete the 'nCase' folder inside Program Files. In older versions without an 'nCase' folder, look in the System folder (inside the Windows folder; called 'System32' under Windows NT, 2000 and XP, or just 'System' on Windows 95, 98 and Me), and delete msbb.exe.

To clean up, you can also delete the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nCASE, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb and HKEY_CURRENT_USER\Software0solutions.

To delete nCase/Inst, if you have the nCase/Inst variant, open the Downloaded Program Files folder inside the Windows folder, right-click the 'nCaseInstaller Class' entry and choose 'Remove'.

nCase Removal