About NCase

Also known as: Adware-180Solutions, n-CASE

"Please be advised that all 180solutions applications are permission based installations requiring the user to explicitly accept the 180solutions End user License Agreement. 180solutions software does not collect or track any personally identifiable information. 180solutions' software also does not transmit information to any third parties. Our software is visible in the user's desktop computing environment clearly identifying itself in the listing of installed programs. Therefore, our applicaiton fails to meet the commercial standard for spyware as described in the Code of Back Channel Conduct." - Keith Smith, CEO, 180solutions, personal communication.

Variants:

• NCase.Alert
• NCase.Inst
• NCase.msbb

Removal Instructions

Automatic Removal:

NCase adware hijacker can be detected and removed Automatically by Spyware Doctor, also SpyEraser.

Manual Removal:

Vigorously resists removal. If you try deleting the obvious files, you will get a popup warning, as shown. n-Case runs nCase.Alart, whose sole purpose is to monitor for removal attempts. This monitor might be invoked by a discrete entry at HKLM/software/Microsoft/Windows/Current Version/Run/ZXLEXTMIK with a value of c:\windows\zxlextmik.exe The name of this will vary from instance to instance.

• Click on the Start button in the bottom left-hand corner of your screen.
• Move your mouse to Settings.
• Click on Control Panel.
• On the control panel, double-click Add/Remove Programs.
• Scroll down until you find Interstitial Ad Delivery by n-CASE or n-CASE.
• Click on the entry, then on the Change/Remove button.
• A dialog box will appear asking you to confirm that you want to disable ad delivery or remove n-CASE. [As noted above, doing this may cause the associated downloaded application to cease operating.]
• Click YES to proceed You will no longer receive n-CASE interstitial advertisements.
• In the Add/Remove Programs list, select n-CASE or PAD Lookups by n-CASE
• If neither of these entries is present in your Add/Remove Programs list, n-CASE has already been uninstalled.

Follow these steps to remove NCase from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

1. Kill these running processes with Task Manager:
   profilepath+\application data\msbb.exe
   profilepath+\fleok\msbb.exe
   profilepath+\local settings\temporary internet files\content.ie5\wv5ruyr9\msbb[1].exe
   programfilesdir+\blue haven media\kazoom\fleok\msbb.exe
   programfilesdir+\blue haven media\kazoom\msbb.exe
   programfilesdir+\hotbar\bin\4.3.6.0\hbinst.exe
   programfilesdir+\hotbar\bin\4.3.6.0\hbsrv.exe
   programfilesdir+\n-case\fleok\msbb.exe
   programfilesdir+\n-case\msbb.exe
   programfilesdir+\ncase\msbb.exe
   programfilesdir+\rosoft\audio tools\msbb.exe
   systemroot+\aknqux.exe
   systemroot+\cjq.exe
   systemroot+\fleok\msbb.exe
   systemroot+\fmtahovc.exe
   systemroot+\ggbilw.exe
   systemroot+\ghrxblvci.exe
   systemroot+\ivdn.exe
   systemroot+\msbb.exe
   systemroot+\neuobsiz.exe
   systemroot+\qtw.exe
   systemroot+\rym.exe
   systemroot+\system32\fleok\msbb.exe
   systemroot+\system32\msbb.exedelmsbb.exe
   elrubiovy.exe
   gm.exe
   ncaseadsuninstaller.exe
   ncaseuninstaller.exe
   optimize.exe
   rosoftlameencoderlimited.exe
   s4setp.exe
   webassist.exe
    
2. Go to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you find the value ghrxblvci, delete it and reboot the machine immediately. If you find the value ivdn, delete it and reboot the machine immediately. If you find the value rjw, delete it and reboot the machine immediately. If you find the value rym, delete it and reboot the machine immediately. If you find the value zxlextmik, delete it and reboot the machine immediately. If you find the value msbb, delete it and reboot the machine immediately.
    
3. Unregister these DLLs with Regsvr32, then reboot:
   profilepath+\application data\ncmyb.dll
   profilepath+\ncmyb.dll
   programfilesdir+\blue haven media\kazoom\ncmyb.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbcoresrv.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostie.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostoe.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostol.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbtoolbar.dll
   programfilesdir+\murasu systems\anjal2000\a2ksertl.dll
   programfilesdir+\ncase\ncmyb.dll
   systemroot+\downloaded program files\ncaseinstaller.dll
   systemroot+\ncmyb.dll
   systemroot+\system32\ncmyb.dllddmp.dll
   efmcnfyu.dll
   ncaselib.dll
    
4. Remove these registry items (if present) with RegEdit:
   HKEY_CLASSES_ROOT\clsid\{6eb5b540-1e74-4d91-a7f0-5b758d333702}
   HKEY_CLASSES_ROOT\ncaseinstaller.ncaseinstaller
   HKEY_CLASSES_ROOT\ncaseinstaller.ncaseinstaller.1
   HKEY_CLASSES_ROOT\typelib\{18dd1792-64fb-42db-acbe-435c598045f4}
   HKEY_LOCAL_MACHINE\clsid\{6eb5b540-1e74-4d91-a7f0-5b758d333702}
   HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6eb5b540-1e74-4d91-a7f0-5b758d333702}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\aknqux
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ghrxblvci
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ivdn
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\rjw
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\rym
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\zxlextmik
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
   \c:\windows\downloaded program files\ncaseinstaller.dll
   HKEY_LOCAL_MACHINE\typelib\{6eb5b540-1e74-4d91-a7f0-5b758d333702}
   HKEY_USERS\.default\software\180solutions
   HKEY_USERS\s-1-5-21-1409082233-1390067357-1801674531-500\software
   \180solutions
   HKEY_USERS\s-1-5-21-1960408961-1993962763-1343024091-1003\software
   \180solutions
   HKEY_USERS\s-1-5-21-725345543-1078145449-1343024091-500\software
   \180solutions
   HKEY_USERS\s-1-5-21-725345543-1078145449-1343024091-500\software
   \microsoft\windows\currentversion\run\msbb
   HKEY_USERS\s-1-5-583907252-823518204-839522115-1003\software\180solutions
    
5. Remove these files (if present) with Windows Explorer:
   profilepath+\application data\msbb.exe
   profilepath+\application data\ncmyb.dll
   profilepath+\fleok\msbb.exe
   profilepath+\local settings\temporary internet files\content.ie5\wv5ruyr9\msbb[1].exe
   profilepath+\ncmyb.dll
   programfilesdir+\blue haven media\kazoom\fleok\msbb.exe
   programfilesdir+\blue haven media\kazoom\msbb.exe
   programfilesdir+\blue haven media\kazoom\ncmyb.dll
   programfilesdir+\ebatesmoemoneymaker\system\code\n.class
   programfilesdir+\hotbar\bin\4.3.6.0\hbcoresrv.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostie.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostoe.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbhostol.dll
   programfilesdir+\hotbar\bin\4.3.6.0\hbinst.exe
   programfilesdir+\hotbar\bin\4.3.6.0\hbsrv.exe
   programfilesdir+\hotbar\bin\4.3.6.0\hbtoolbar.dll
   programfilesdir+\hotbar\bin\4.3.6.0\install.scr
   programfilesdir+\murasu systems\anjal2000\a2ksertl.dll
   programfilesdir+\n-case\fleok\msbb.exe
   programfilesdir+\n-case\msbb.exe
   programfilesdir+\ncase\msbb.exe
   programfilesdir+\ncase\ncmyb.dll
   programfilesdir+\rosoft\audio tools\msbb.exe
   systemroot+\aknqux.exe
   systemroot+\cjq.exe
   systemroot+\downloaded program files\ncaseinstaller.dll
   systemroot+\downloaded program files\ncaseinstaller.inf
   systemroot+\fleok\msbb.exe
   systemroot+\fmtahovc.exe
   systemroot+\ggbilw.exe
   systemroot+\ghrxblvci.exe
   systemroot+\ivdn.exe
   systemroot+\msbb.exe
   systemroot+\ncmyb.dll
   systemroot+\neuobsiz.exe
   systemroot+\qtw.exe
   systemroot+\rym.exe
   systemroot+\system32\fleok\msbb.exe
   systemroot+\system32\msbb.exe
   systemroot+\system32\ncmyb.dllddmp.dll
   delmsbb.exe
   efmcnfyu.dll
   elrubiovy.exe
   fiz1
   gatorcontact.log
   gm.exe
   iconadd.log
   inctrl.log
   install.html
   kyf.dat
   license-rosoft-adware.txt
   ncaseadsuninstaller.exe
   ncaselib.dll
   ncaseuninstaller.exe
   optimize.exe
   popup.log
   riviera gold casino!.url
   riviera gold casino.url
   rosoftlameencoder.chm
   rosoftlameencoderlimited.exe
   s4setp.exe
   spam.html
   uninstall.log
   webassist.exe
    
6. Remove these directories (if present) with Windows Explorer:
   profilepath+\fleok
   programfilesdir+\ncase
   programfilesdir+\rosoft\audio tools
   systemroot+\fleok
    
7. After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here's how.

Removal Instructions for Other Adwares & Spywares