Ad delivery software

It came to my attention a few days ago that unbeknownst to me, there appears to be a piece of software installed and registered on my system called n-Case. Now, n-Case is an ad delivery system which is responsible for many of the annoying popups that thanks to using Firebird as a browser, I don't have to see.

However, I don't like the fact that this software was installed without my consent, and when I try to uninstall it using the Control Panel, it says that I must connect to the n-Case server to uninstall this software. This is completely unacceptable that I should not be able to delete something off of MY computer at will, and without having to connect to the internet.

So, I ask you, in what ways can I delete this ad delivery system WITHOUT connecting to the internet, and how do I prevent future reoccurences of this type of thing?

I worked on a customer's computer and also had that software installed. Only way i found to be able to delete it was to actually connect to the internet and uninstall it. I agree with you.You shouldnt have to be that way.

I believe that software was installed when u visit a web page and not sure if its also bundled with clock sync.

How to uninstall n-Case

Manual uninstall

Quote:

---

Removal
There is an uninstall feature for nCase, but it is a bit of a bad joke. You have to go to Add/Remove Programs in the Control Panel, choose 'Insterstitial ad delivery by n-Case', click 'Remove', confirm you are connected to the internet and download the uninstaller EXE. (This only works if Active Scripting in Internet Explorer is set to 'Enable', not 'Disable' or 'Prompt'.)

Run the uninstaller (which will again ask for internet access) and then do the whole lot over again for the entry 'PAD lookups by n-Case'. And it still sometimes doesn't work, for unknown reasons.

To add injury to insult, this method does not remove the installer control, so if you had the nCase/Inst variant, any web page will be able to re-install nCase without any prompting.

You may find it easier to remove by hand.

Manual removal
Open the registry (click 'Start', choose 'Run' and enter 'regedit'), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, right-click the entry 'msbb' inside it, and click 'Delete'.

Restart the computer and you should be able to delete the 'nCase' folder inside Program Files. In older versions without an 'nCase' folder, look in the System folder (inside the Windows folder; called 'System32' under Windows NT, 2000 and XP, or just 'System' on Windows 95, 98 and Me), and delete msbb.exe.

To clean up, you can also delete the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nCASE, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb and HKEY_CURRENT_USER\Software\180solutions.

To delete the installer control, if you have the nCase/Inst variant, open the Downloaded Program Files folder inside the Windows folder, right-click the 'nCaseInstaller Class' entry and choose 'Remove'

---

You should be able to remove the regestry entries to it, that should stop it doing it's thing. Then just delet it. Just make sure you have a back up of the regestry befor you start.

As for avoiding this sort of stuff always read the install notes when installing freeware. As most of it comes with adaware of some sort in with it.

Keep your OS patched upto date along with your browser, that will reduce the chances of a web sight highjacking your browser.

Install some adblocking app.

Tighten your browsers secuity settings and privacy settings.

The folks at http://www.180solutions.com/Consumer...Uninstall.aspx who distribute N-Case make it seem like you need to connect to them to remove this but spyware removers like adaware from lavasoft http://www.lavasoft.de/ works fine at removing this... so to does spybot i think and others
... cheyana

well, thanks much for all the helpful replies.

It's not really a problem, since I usually run on my Linux or AIX box, but I'd rather not have this POS installed.

Thanks again

My system(s) have also had "un-authorized" software loaded without user permission. It happens in the background.

Today; while testing a new firewall - a program called "LOADER.EXE" attempted to run/connect to a website. It is not a file or program I loaded, nor is it a Microsoft system
file.

Properties of the file say it's real name is HOLE.EXE. and version 1.0.0.0. (thats all)

So far, I cannot find any virus or spyware site that lists either LOADER.EXE or HOLE.EXE
(Novell uses a loader.exe legitimately) for Windows.

Anyone seen this file before ?

I found one reference to hole.exe which suggests it's a screen saver. Not sure if this helps you at all, but you can check it out here:

http://www.softlookup.com/download/down13730.html

Cheers:

DJM....thanks for the link. NO it is not the same file.
I removed it about 2 hours ago (loader.exe) and rebooted.

After surfing for a few minutes.....have 4 instances running as processes.

Gotta find out what this is. It ain't good

The only thing I came up with was somewhat related to adware (here is the site): http://www.netwu.com/samples/www.adt...om/sitemap.xml . The only other lead was this site, which had to do with client/server security: http://homepages.ius.edu/rwisman/A348/html/Security.htm

An update to my earlier 'LOADER.EXE' comments.

Spywareinfo.com confirmed it is malware/spware and added it to HIJACKTHIS
Symantec have declared it as a trojan

A lot of programs use a file called 'loader.exe'.....the one I kept getting came through my web browser.