Forum Settings
       
Reply To Thread

Koalian only you can defeat this evil!Follow

#1 Mar 19 2004 at 8:42 AM Rating: Excellent
**
491 posts


Koalian I need some of your computer wisdom.

I was checking out some other EQ sites, (that's the last time I go anywhere except Alla) and I picked up a bug. It keeps launching pop ups, and wants me to click on them to prevent even more pop ups. And it changes my home page to Navpop. Scumbags!

I have run McAfee 3 time and deleted or quarantined the files it has found, same with Spybot. It will not let me do anything with a file named. n-Case. Bastards!

Have you heard of these jerks. Have any idea how to get ride of the crap.

Thanks
#2 Mar 19 2004 at 8:59 AM Rating: Excellent
Avatar
******
29,919 posts
Yup, that's a bad one. Here are nukeing instructions:

Please note: This fix requires editing the registry. If you have never done this before, I highly reccommend you find someone local that can assist you, as you can ***** up your computer if you do this wrong, requiring a windows reinstall.

Open the registry (click 'Start', choose 'Run' and enter 'regedit'), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, right-click the entry 'msbb' inside it, and click 'Delete'.

To delete nCase/Alert, also check for a randomly-named entry three or more letters long, pointing to a .EXE of the same name in the Windows folder. Delete this entry and the file it points to. Alternatively, wait for the next restart and it should prompt to you reinstall or remove itself.

Restart the computer and you should be able to delete the 'nCase' folder inside Program Files. In older versions without an 'nCase' folder, look in the System folder (inside the Windows folder; called 'System32' under Windows NT, 2000 and XP, or just 'System' on Windows 95, 98 and Me), and delete msbb.exe.

To clean up, you can also delete the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nCASE, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msbb and HKEY_CURRENT_USER\Software\180solutions.

To delete nCase/Inst, if you have the nCase/Inst variant, open the Downloaded Program Files folder inside the Windows folder, right-click the 'nCaseInstaller Class' entry and choose 'Remove'.
#3 Mar 19 2004 at 10:20 AM Rating: Excellent
**
491 posts
I have been able to do all of the steps except this one. I'm not sure how to find a randomly named file. Could you shed a little more little light on this step, please.

I did everything except this part and of course it's just keeps reinstalling itself.

Thanks for you help Kao





To delete nCase/Alert, also check for a randomly-named entry three or more letters long, pointing to a .EXE of the same name in the Windows folder. Delete this entry and the file it points to. Alternatively, wait for the next restart and it should prompt to you reinstall or remove itself.
#4 Mar 24 2004 at 7:20 AM Rating: Excellent
Avatar
******
29,919 posts
That entry should be in the regestry somewhere inside HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

it will say something about a file C:\windows\###.exe where # is a random letter. It should be the only one in there. there should also be a file in the C:\windows\ directory by the same name. deleate the key and the file and you will be set.
#5 Mar 24 2004 at 8:15 AM Rating: Excellent
**
491 posts
Thanks for you help Koa!
Reply To Thread

Colors Smileys Quote OriginalQuote Checked Help

 

Recent Visitors: 73 All times are in CST
Anonymous Guests (73)