What Is Ncase?

[mr00420]

When I connected to my server and connected to Kazaa, my new firewall ask if it was o.k for Kazaa to connect to my PC, then after that, it asked if nCase (msbb?) could connect to the internet. Not Knowing what it is I click "not this time." What is nCase and how did it get on my PC? Shouls I remove it? How should I do that? It doesn't seem to show up in the "Add/Delete programs menu."

[lynx]

NAV says it is adware. It isn't, it's a trojan.

That's the very reason I dumped NAV and switched to AVG.

Sounds like Panda thinks it is adware too. Thanks for the heads up on that, someone was asking me whether Panda was worth looking at. Seems the answer is no.

There are some removal instructions here (http://www.pchell.com/support/ncase.shtml), but I'va got a feeling it could be more complicated than that. It is "self updating", which actually means your machine is wide open to other trojans that use it as a transport/installer. I found no less than 7 of these adware/trojan progs on the pc that had nCase, none was flagged by NAV. I ended up deleting ALL the ActiveX controls in order to be sure I'd killed it.

Good luck with this one, removing nCase is easy, removing some of the other stuff that came it installed can be a swine.

Edit: a little investigation has reminded me that it wasn't nCase itself that prompted me to dump NAV, but some of the other progs that were downloaded by it. Personally I think it should be highlighted as a trojan simply because of it's behaviour.

[hungrylilboy]

yes ncase its self is adware but as lynx said it also leaves u open as a trojan does.
have u got it all un-installed? let me know as i had this a while ago and i found a decent site that shows u how to get rid of it.
unfortunately u might have to go into the reg if ur unlucky

let me know if ur still having trouble and i'll post the link

[mr00420]

No I was at work so I'm going to uninstall it now. Do you have a better site than Linx (thanks BTW?)

[dopey]

if you're comfortable with editing the registry, check here:

http://www.pchell.com/support/ncase.shtml

other wise you can download hijack this here (http://www.spywareinfo.com/~merijn/files/hijackthis.zip).

scan and save a log-- post the contents here.

[mr00420]

OK I think I've removed nCase, but how do I check? Is there a site that will check your PC for nCase?

[lynx]

Spybot?
Adaware?

[dopey]

yes, as lynx said, you can scan with either spybot or adaware.

but to be sure, i suggest you just post your log. ;)

sometimes there is a little cleanup to be done afterwards.

[hungrylilboy]

in answer to ur question where did it come from, it comes with emoticon packs amongst other things.

to remove if u havent by now go here (http://www.mess.be/msnmessengerfaq/idx/0/063/article/I_have_installed_emoticons_from_emoinstallercom_but_now_I_got_adware_called_nCase.html) and read the instructions carefully

as the others said, scan with adaware and spybot

the above site also shows where to look to see if u have it left or not

[mr00420]

i tried Spybot b/c hijackthis wouldn't work (kept asking to find mplayer2.exe and wouldn't locate it on my PC.) It seems there's no ncase on my PC, although there was Cydoor etc.