|
 |
|
|
| How to delete nCase (180Search) - Removal tool, fix instructions |
|
nCase (180Search)
Name: nCase (180Search)
Aliases: 180search Assistant, 180solutions n-Case, n-Case, Adware/Ncase
Type: Spyware (subtype adware)
Size: 108,010
First appeared on: 11.09.2003
Damage: Low
Brief Description:
nCase is an adware type program, which offers the application at the only cost of viewing a series of advertisements.
According to the company that created it, nCase is executed in the background and it displays information, offers and products according to keywords previously entered by the user while surfing the Internet. However, nCase downloads and displays advertisements, founding on the Internet usage habits.
In addition, nCase modifies the browser Internet Explorer homepage as well as some of its search options.
Visible Symptoms:
nCase is very easy to recognize before it affects the computer, as it displays the following message when it is being installed:
You are about to install the 180search Assistant, a permission based search assistant application that provides you access to a wide range of websites, applications ans information. The 180 Search Assistant:
- Will show a typical user 2-3 sponsors' websites daily based on their browsing activity
- Anonymously collects information about the websites you visit in order to show you websites that you are interested in
- Does not collect personally identifiable information
- Can be uninstalled at any time by doing the "Add/Remove Programs" menu on your computer and selecting "Uninstall 180search Assistant"
Once it has reached the computer, nCase changes the browser Internet Explorer homepage for the one, offering poker, debt consolidation, pay day loans and casino links.
Technical description:
File names: Msbb.exe, Boomerang.exe, ClientAX.dll, 180SAInstaller.dll, setup4156.exe, sac.exe, sau.exe
nCase creates the following files:
- A file with a random name and an EXE extension in the Windows directory.
- 180SAINSTALLER.DLL and 180SALIB.DLL in the folder Downloaded Program Files in the Windows directory. These files are DLLs (Dynamic Link Libraries).
- Several files in the subfolder 180SEARCH ASSISTANT, created by nCase in the Program Files directory.
nCase creates the following entries in the Windows Registry:
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
%entry% = %windir%\ %file%.exe
where %windir% is the Windows directory, and %entry% and %file% are the random names of the entry and the file created.
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
msbb = %ProgramFiles%\ 180search assistant\ msbb.exe
where %ProgramFiles% is the folder Program Files.
By creating these entries, nCase ensures that it is run whenever Windows is started.
- HKEY_CLASSES_ROOT\ 180SAInstaller.180SAInstaller
- HKEY_CLASSES_ROOT\ CLSID\ {B10031B2-F184-4803-9A88-D239C0641D70}
- HKEY_CLASSES_ROOT\ Interface\ {DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}
- HKEY_CLASSES_ROOT\ TypeLib\ {F2BF4713-E933-4B66-8694-22ED243709C7}
- HKEY_CURRENT_USER\ Software\ 180solutions
- HKEY_CURRENT_USER\ Software\ msbb
- HKEY_LOCAL_MACHINE\ Software\ 180solutions
- HKEY_LOCAL_MACHINE\ Software\ Classes\ 180SAInstaller.180SAInstaller
- HKEY_LOCAL_MACHINE\ Software\ Classes\ CLSID\ {B10031B2-F184-4803-9A88-D239C0641D70}
- HKEY_LOCAL_MACHINE\ Software\ Classes\ TypeLib\ {F2BF4713-E933-4B66-8694-22ED243709C7}
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Code Store Database\ Distribution Units\ {B10031B2-F184-4803-9A88-D239C0641D70}
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ ModuleUsage\ %WindowsRoot%\ Downloaded Program Files\ 180SAInstaller.dll
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ ModuleUsage\ %WindowsRoot%\ Downloaded Program Files\ 180SALib.dll
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ msbb
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ SharedDLLs %WindowsRoot%\ Downloaded Program Files\ 180SAInstaller.dll
- HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ SharedDLLs %WindowsRoot%\ Downloaded Program Files\ 180SALib.dll
- HKEY_LOCAL_MACHINE\ Software\ msbb
- HKEY_CURRENT_USER\ Software\ Microsoft\ Internet Explorer\ Main "Search Bar" http://best-search.cc/search.php*
- HKEY_CURRENT_USER\ Software\ Microsoft\ Internet Explorer\ Main "Search Page" http://best-search.cc/search.php*
- HKEY_CURRENT_USER\ Software\ Microsoft\ Internet Explorer\ Main "Start Page" http://best-search.cc/search.php*
- HKEY_USERS\.DEFAULT\ Software\ Microsoft\ Internet Explorer\ Main "Search Bar" http://best-search.cc/search.php*
- HKEY_USERS\.DEFAULT\ Software\ Microsoft\ Internet Explorer\ Main "Search Page" http://best-search.cc/search.php*
- HKEY_USERS\.DEFAULT\ Software\ Microsoft\ Internet Explorer\ Main "Start Page" http://best-search.cc/search.php*
Propagation:
nCase can be manually installed or be included with other applications.
Removal tool and instruction:
- Uninstall nCase from the Control Panel, option Add or Remove programs, by deleting the application named 180Search Assistant.
- Delete all the files and entries in the Windows Registry that nCase has created, detailed in section above.
- Restart the computer.
You can also try to use Adware.180Search Removal Tool from Symantec.
Click here to download the tool.
AntivirusWorld recommends:
If you're not sure you can remove the virus manually, use one of the following antiviruses:
|
|
|
|
|
