August 27th, 2003, 04:06 AM
Ad delivery software
It came to my attention a few days ago that unbeknownst to me, there appears to be a piece of software installed and registered on my system called n-Case. Now, n-Case is an ad delivery system which is responsible for many of the annoying popups that thanks to using Firebird as a browser, I don't have to see.
However, I don't like the fact that this software was installed without my consent, and when I try to uninstall it using the Control Panel, it says that I must connect to the n-Case server to uninstall this software. This is completely unacceptable that I should not be able to delete something off of MY computer at will, and without having to connect to the internet.
So, I ask you, in what ways can I delete this ad delivery system WITHOUT connecting to the internet, and how do I prevent future reoccurences of this type of thing?
August 27th, 2003, 04:27 AM
I worked on a customer's computer and also had that software installed. Only way i found to be able to delete it was to actually connect to the internet and uninstall it. I agree with you.You shouldnt have to be that way.
I believe that software was installed when u visit a web page and not sure if its also bundled with clock sync.
August 27th, 2003, 04:36 AM
How to uninstall n-Case
There is an uninstall feature for nCase, but it is a bit of a bad joke. You have to go to Add/Remove Programs in the Control Panel, choose 'Insterstitial ad delivery by n-Case', click 'Remove', confirm you are connected to the internet and download the uninstaller EXE. (This only works if Active Scripting in Internet Explorer is set to 'Enable', not 'Disable' or 'Prompt'.)
Run the uninstaller (which will again ask for internet access) and then do the whole lot over again for the entry 'PAD lookups by n-Case'. And it still sometimes doesn't work, for unknown reasons.
To add injury to insult, this method does not remove the installer control, so if you had the nCase/Inst variant, any web page will be able to re-install nCase without any prompting.
You may find it easier to remove by hand.
Open the registry (click 'Start', choose 'Run' and enter 'regedit'), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, right-click the entry 'msbb' inside it, and click 'Delete'.
Restart the computer and you should be able to delete the 'nCase' folder inside Program Files. In older versions without an 'nCase' folder, look in the System folder (inside the Windows folder; called 'System32' under Windows NT, 2000 and XP, or just 'System' on Windows 95, 98 and Me), and delete msbb.exe.
To clean up, you can also delete the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nCASE, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb and HKEY_CURRENT_USER\Software\180solutions.
To delete the installer control, if you have the nCase/Inst variant, open the Downloaded Program Files folder inside the Windows folder, right-click the 'nCaseInstaller Class' entry and choose 'Remove'
is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.
August 27th, 2003, 04:45 AM
You should be able to remove the regestry entries to it, that should stop it doing it's thing. Then just delet it. Just make sure you have a back up of the regestry befor you start.
As for avoiding this sort of stuff always read the install notes when installing freeware. As most of it comes with adaware of some sort in with it.
Keep your OS patched upto date along with your browser, that will reduce the chances of a web sight highjacking your browser.
Install some adblocking app.
Tighten your browsers secuity settings and privacy settings.
What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry
August 27th, 2003, 04:46 AM
The folks at http://www.180solutions.com/Consumer...Uninstall.aspx who distribute N-Case make it seem like you need to connect to them to remove this but spyware removers like adaware from lavasoft http://www.lavasoft.de/ works fine at removing this... so to does spybot i think and others
Every time I close the door on reality it comes in through the windows. —Jennifer Unlimited
August 27th, 2003, 06:37 AM
well, thanks much for all the helpful replies.
It's not really a problem, since I usually run on my Linux or AIX box, but I'd rather not have this POS installed.
August 27th, 2003, 09:23 PM
My system(s) have also had "un-authorized" software loaded without user permission. It happens in the background.
Today; while testing a new firewall - a program called "LOADER.EXE" attempted to run/connect to a website. It is not a file or program I loaded, nor is it a Microsoft system
Properties of the file say it's real name is HOLE.EXE. and version 184.108.40.206. (thats all)
So far, I cannot find any virus or spyware site that lists either LOADER.EXE or HOLE.EXE
(Novell uses a loader.exe legitimately) for Windows.
Anyone seen this file before ?
August 27th, 2003, 09:33 PM
I found one reference to hole.exe which suggests it's a screen saver. Not sure if this helps you at all, but you can check it out here:
August 28th, 2003, 09:31 AM
DJM....thanks for the link. NO it is not the same file.
I removed it about 2 hours ago (loader.exe) and rebooted.
After surfing for a few minutes.....have 4 instances running as processes.
Gotta find out what this is. It ain't good
August 28th, 2003, 04:42 PM
The only thing I came up with was somewhat related to adware (here is the site): http://www.netwu.com/samples/www.adt...om/sitemap.xml . The only other lead was this site, which had to do with client/server security: http://homepages.ius.edu/rwisman/A348/html/Security.htm
Strike Like Lightening...Envelop Like Darkeness...
As Strong As Thunder...As Swift As The Wind...
As Calm As the Water...~Sun Tzu~