[Kellie aka Ms. B]

I had disabled n-case the other day after I felt I had accumulated enough evidence of their activites. I rebooted my computer this am to reactivate their software. I visited numerous web sites and did not get ONE popup by n-case. Hmmm...imagine that. I was actually wanting to run n-case to SEE if that was going to the case.

So.....to test my theory as to whether n-case had either been able to detect my particular system and discontinued activity of their software to me specifically as I could be a possible entity testing the doings of their software or just had terminated activity overall while possible testing was occurring (found this one a bit hard to believe that they would take that kind of hit) I did a bit more 'testing.'

I took several steps to remove their software which goes well beyond what the normal end user would do or even know to do. I'll not outline everything I did here publicly. http://abw.infopop.cc/infopop/emoticons/icon_wink.gif After all these steps and rechecking my system in more than one way to see if there was any evidence of their software still on my computer and I found no evidence.

I then went back to reinstall their software. Below is the screen shot of what I got when I started to download an app n-case comes bundled with. http://abw.infopop.cc/infopop/emoticons/icon_eek.gif http://abw.infopop.cc/infopop/emoticons/icon_eek.gif Obviously all components of their software were NOT removed despite the extraordinary measures I took to rid them of my system!

Anyhow, I choose the option to fully uninstall n-case and remove any other existing files and then I reinstalled n-case.

Miracles of miracles! The very first browser page load I which was to an affiliates site elicited an n-case pop up to Overstock containing 180Solutions LS tracking ID!

Now I have a pretty good idea as to how n-case was able to terminate myself receiving their popups, which again I will not post publicly here. And will discount or verify with some further testing.

But to any and all merchants and networks doing testing on n-case, I only have the following to say. If you truly want to run legitimate testing, then contact me privately for details on steps you MUST take to ensure you are performing testing which is not being interfered with by the very one you are testing! If you don't make sure your testing is legimate, I don't think there is anyone here who is going to want to hear or believe it if we hear that you couldn't replicate the results of the 50 or so videos I have documented so far.

And to 180Solutions....you got to get up a bit earlier in then day to keep me from doing testing. http://abw.infopop.cc/infopop/emoticons/icon_razz.gif

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[ecomcity]

I've twice received 180Solutions/N-case by drive-by hidden installs. Just like in your senerio Ms.B, the damn program and all 11 components will not un-install completely. Every re-boot allowed it to rebuild the deleted files. Went to the Google Gods and visited several spyware/adware forums to get all the removal instructions.

This cancer of a BHO violates every meaning and term of the CoC and LS adendium. Making it go away is nothing for the normal enduser to easily accomplish. Thought the CoC was supposed to enforce a one step, Windows based, removal procedure.

Mike & Charlie ... http://abw.infopop.cc/smilies/parrot.gif

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[Trust]

"The very first browser page load I which was to an affiliates site elicited an n-case pop up to Overstock containing 180Solutions LS tracking ID!"

LS needs to give them the boot.

I work in lounge pants http://abw.infopop.cc/infopop/emoticons/icon_razz.gif

[bobince]

There are two 'extra' parts of the nCase software, which are causing the issues described here, and which are not installed by all versions of the software.

Firstly, there is an ActiveX drive-by-download control. (I refer to this as nCase/Inst.) This is only present when the software has been installed through a drive-by, not a bundle with another application. nCase/Inst installs the nCase software only on its first run, so once it is installed it won't normally reinstall the main nCase program even if that gets uninstalled. This is why you didn't get installs before you completely removed ActiveX control.

Secondly, there's a separate, randomly-named executable (which I refer to as nCase/Alert), which is only present in newer variants of the software. It runs on startup and detects when the main nCase program is missing; if so, it presents the above dialogue box. This is actually an improvement because the uninstall option works much better than the procedure the Add/Remove Programs entry tries to send you through.

So, I don't think nCase is deliberately 'hiding' if it thinks it is being tested, it's just a side-effect of the way the new components work together.

--
Andrew Clover
mailto:and@doxdesk.com
http://www.doxdesk.com/

[Kellie aka Ms. B]

Hi Andrew,

Thanks for your input. I did see that randomly-named exe running after I reinstalled (it was probably still showing since it was right after I intentionally reinstalled).

I think I wasn't clear in my post perhaps. http://abw.infopop.cc/infopop/emoticons/icon_biggrin.gif That dialogue box was actually a side thing that happened when I was attempting to uninstall my previous version of n-case and do a completely fresh install.

I wasn't going to spell it out, but guess I will.

The point I was attempting to make is that I had ctrl alt del n-case to shut it down over the weekend so I haven't been running it for a few days. Not since things went public here and all heck broke out. I attempted to restart n-case today but rebooting my computer. I did a reboot a couple of times. n-case was functioning because I got my firewall prompt at start up, it was showing running in task manager, and it was writing to files on my hard drive associated with n-case. It WAS NOT however generating ANY pop ups.

Hmmm..hmmmm...hmmmm said I. Another part of n-case aside from the pop ups is that it logs every URL you visit in 30kb files which supposedly transferred back to 180Solutions. I suppose this is where they get their demographic information that is sold on their site. It seemed to me that those files may be of benefit to 180Solutions when tied to a particular user if they wanted to "hide" from testing.

All the other stuff with that dialogue box came from my attempts to completely remove n-case from my system and connections with the first install to reinstall another version and get my pops back. Which is what I did.

Anyone doing testing needs to think of the possibilities if they aren't seeing activity. That all surfering on the system running the app is being tracked. Of course..that could all change now. http://abw.infopop.cc/infopop/emoticons/icon_smile.gif

[Edited to add]

I don't know how frequently those logs are transferred back to 180Solutions, but I'll see if I suddenly lose functionality of the software again. http://abw.infopop.cc/infopop/emoticons/icon_biggrin.gif

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[jtstephens]

Overstock.com researched the 180Solutions application and determined that it was indeed parasitic. Consequently, we temporarily suspended 180solutions from our program. We will not permit them to rejoin until they comply with generally accepted affiliate marketing practices.

Thanks BLFH for bringing this to our attention!

J.T. Stephens
Affiliate Program Manager
Overstock.com
801.947.3234
jstephens@overstock.com

[flamingoworld]

JT, what about affiliates that are using 180Solutions to advertise? Will they be suspended too?

[jasonco12]

hmm I got this program NCase on my system several times. and several times it wouldn't uninstall completely and it wiped out my hard drive, and ended up losing everything. just FYI, This program does damage to your hard drive. So be careful if this is on your computer.

<a href="http://abw.infopop.cc/6/ubb.x?q=Y&a=tpc&s=548608979&f=179600589&m=5876081315&p=2"target="_blank">Affiliate goals<a>

Together as a team we can make a difference!
Spend your life lifting people up, not putting people down. --Unknown

[Drewbert]

And in the meantime, until MS get's it's fingerout of it's arse and updates IE, push alternative browsers on all your websites.

Put download links on your sites and tell people to try Netscape's tabbed browsing.

Every person you move off IE is a person whose commission payments will go to the affiliate who deserves them.

DO IT!

****************************
Jimmy James Inc. fan club membership # 3312

"But Jimmy had fancy plans, and pants to match"

[Graham figleaves]

Hi

I myself am looking at testing nCase. I installed it from the 180 site last night, but failed to receive any pop-ups. Is it something to do with the fact I downloaded a version from their site, or is there something else I should be doing?

Any assistance appreciated.

Regards
Graham

[benflux]

Hi Graham,

Are you talking personally or are Figleaves trying this nCase?

Ben
Emporio Lingerie

[Graham figleaves]

Personally. When I say testing, I mean how it works, how they overwrite cookies, how hard is it to uninstall etc.

Graham Keen
Figleaves.com

graham.keen@NO_SPAM_figleaves.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Over 120 brands...Fast FREE Shipping

[Chris - AMWSO]

Thanks Andrew and Mrs B fir that very good extra info. Though, to be honest i don't think I need to test 180...ever again...I've seen more than enough from these guys to click the "eject button" on reflex when ever I see them sign up or sneak into a program.

I need to get the team to install GRS next and give that a good going over.

Cheers

Chris

<font size="1">Web Studio-1 Solutions.
MSN - Khun Kwai ::: TEL - INT +662 635 1255 ::: URL - www.amwso.com (http://www.amwso.com)

Low Threshold : High Return Days : Excellent Support : 100% Parasite Free
WesternUnion.com (http://www.westernunion.com) - Netmagazines.com (http://www.Netmagazines.com) - Mondera.com (http://www.mondera.com) - KegWorks.com (http://www.kegworks.com) - Left On Main (http://www.leftonmain.com)
DriveWerks.com (http://www.DriveWerks.com) - DeluxeGrills.com (http://www.DeluxeGrills.com) - GreatSkin.com (http://www.GreatSkin.com) - Vegas Experts (http://www.vegasexperts.com) - Pierced Body (http://www.body-jewelry-body-piercing.com)</font>

[happypoon]

Hi Graham,

Ncase nor anyone else for that matter has to do a popup to set or overwrite a cookie. If you're doing testing to detect potential foul play or abuse on cookies you must keep an eye on the cookies that are created / modified and determine if the cookies contain tracking information or if they are simply image based cookies or not.

Hopefully you have enough knowledge of your cookie and or the networks cookie you belong in to be able to determine if tracking cookies were created or not.

A typical testing scenario would be:
1) delete cookies from your machine.
2) Make sure and turn any popup blocker off.
3) visit merchant and or other affiliate sites - on each step of your navigation, you should refresh the cookie folder to see what cookies have been created / changed and review them as needed for tracking identification.

I dont know specifics of your program but if you need help with one of the networks cookie details, let me know and I'll try and fill in some blanks.

** Have you asked for change? **

[vipgroup]

I think this site will automatically detect if you have the nCase pest installed and shows you how to remove it.

DoxDesk (http://www.doxdesk.com/parasite/)