Win32:NcaseSpy [Trj]

Viruses and worms
1

My scanner picks up on Win32:NcaseSpy [Trj] usually on some temp file in my Windows directory. All of my lazy attempts have failed and now that i’m looking into it, i can’t find any information on it.

What is this virus and how can i get rid of it?

It doesn’t make much sense that Avast can tell me the name of the virus but no information on what it is or how to remove it. Am I missing something on the website or is it not there?

any help would be much appreciated, thanks.

2

Hi,
which Win do you have ?

look here:
http://www.doxdesk.com/parasite/nCase.html

and enter
ncasespy
into the boardsearch above

Also apply all Windowsupdates and secure your IE (disable activeX & scripting except for know, secure sites…)

SPYBOT and ad-aware might also help

:wink:

3

Sometimes SpyBot and Adaware won’t work on these tricky little censored Sorry for the language…these viruses are starting to get on my nerves. I’m like, five seconds away from formatting my damned computer. Anyways, you can always try google to find some info on this virus and ways on getting rid of it manually. Get ready for a long night of looking in the registry…

4

Win XP Home

I have set IE to be pretty much useless, completely restricting most actions as I only use Opera.

Google comes up with nothing except a link to here and a couple of forums with people asking the same thing.

I’m not verry compitent outside of the “user-friendly” Windows which is a sad, sad thing. Does anyone know what this one does? anything i shouldn’t be doing on the pc such as bank transactions and what not?

5

Damnit I need to get something better than IE. Seriously, MicroShaft is starting to piss me off.

EDIT: For starters, you should never do bank transactions online. It’s just…not safe. Especially if you do have a virus you don’t know about. Polymorphic viruses can be on your system and you wouldn’t even know about them until the last minute.

6

here here

7

I’m like two seconds away from getting a Macintosh damnit. I work on one at school so…it’s not such a big deal anymore.

8

I have just the same on my PC. AVAST finds it, I delete :frowning: :frowning: file & Virud, AVAST says all OK when I rerun AV, but it comes back next time I am online. Help!

9

It probably comes back on every system reboot. Do a registry check. Maybe there’s something in your Windows entries that have a dll which brings up the virus every time you restart.

10

does anyone know what this one is doing though? what is it’s point? any program to kill it? the registry came up with nothing.

11

Hi Montey3,

After replacing yesterday AVG by Avast! pro, Avast found me that trojan while in its first boot scan. I run Windows XP Home Edition SP1.

The trojan files were:
1- C:\Windows\epkdcjqj.exe
2- C:\Windows\lklqbuj.exe
3- C:\Windows\srkvoh.exe

and another two, perhaps related to:
4- C:\Program Files\ClearSearch\Loader.exe
5- C:\Windows\System32\Clrschp052.exe

I RUN ‘regedit’ and searched the above file names
I found the files 1 to 4, only in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Note: from the place (on the left column) your cursor is, one needs to press (perhaps several times) the first letter of the next directory name to reach it.

I deleted the lines (on the right panel of the registery) of the above 4 files by right clicking on them and choose delete.

Then I let Avast to reboot my computer to scan again C:\Windows
To be on the safe side :slight_smile: I just moved them when asked even the 5th file since I had no trace of it in the registery.

When XP is running and I let Avast scan the memory, there was no trace of them.

I am rather a newbie in playing those games especially in altering the registery… So I search a lot before deciding to delete or rename anything :-\ I used to play with DOS ;D

Kerim

12

Problem solved:

  1. I changed to AVG 6.0 free Anti Viris MUCH better than AVAST. It foundVirus, identified it correctley & deleted it. You also need to delete a lot of other files in temp file as its a Trojan:
  2. AVG also found other Virus that AVAST had not found.
13

Oh really my friend? Well I tried all that plus AVG didn’t even detect the virus and I tried everything else in this forum but nothing seems to work. NCaseSpy keeps coming back! :cry:

14

Hi Ruddy,

  • please follow the instructions in the link below “VirusRemoval”
  • if you can’t resolve it then, please supply more info including a hijackthis-log :wink:
15

You Could try a trial TDS-3 From http://www.diamondcs.com.au/ Hope this helps

16

i have been trying to get rid of this virus and i found out it was in MY SEARCH and in SEARCH ASSISTANT and 180SEARCH after i deleted them i have had no problems. fingers crossed. hope this might help some others good luck … ;D

17

I found that virus was able to be deleated only after you removed the spyware that came with it in my case it was daily horoscope , after i removed that i could deleate the virus fully. :wink: , had the same problem with win32:rameh , fixed it the same way … goodluck

18

After i got rid of the win32:ncasespy. i downloaded a spybot and it blockes it from coming back i have not had any trouble with it since. it seems to be downloaded on to your system when you open a web page and it has a spyware attatched this is what carries the win32 pain, i dont know if this will help anyone else but i hope it might .
good luck…

19

how to kill nscapespy

20

Welcome to this board letjoelle

Search this board with keyword “NcaseSpy” and you will find several threads explaining it.