How Block Unwanted Software From Starting

Page 2 of 4 FirstFirst 1234 LastLast
  1. Barman58's Avatar
    Posts : 3,930
    Windows 10 Pro x64 2004 - 19041 - 264 XP/Vista/Win7/Win8.1 in VM for testing
       #11

    GarCooper said:
    Windows 10 Version 1903

    NCH Software seems to have installed 28 of their programs on my PC. There is a directory showing shortcuts to them, including one called Doxillion.

    Now, when I try to edit a doc file by clicking on the filename in my directory program, l get a message telling me to run Doxillion if I want to edit the doc.

    None of the NCH programs are listed in the installed apps in Windows Settings, so I can't uninstall.

    How do I block or uninstall the NCH stuff?

    Thanks.
    Every filetype DOC, Txt, JPG, etc has a default application that is set to open or otherwise work with the file type - It would appear that NCH have changed the Default for some of the standard file types to run a program that just "suggests" you use their program Without loading the full program this is behaviour which is close to a Malware attack, not something that you expect from a legitimate company.

    However, there is an entry in each filetype that sets this association "File type to Application" if you right click on a file of the type that is being Hijacked eg DOC there is a en entry "Opens With ... " you should be able to set that to whatever you want to open your files with.

    I would personally look at your system using Microsoft's Autoruns which lists every item that starts when windows does this could be used to block any programs by NCH from loading, (the basic usage is to uncheck a checkbox next to each item that is set to run on system startup), It can be a little intimidating as the amount of items that load with windows is huge. Careful use can however sort issues in a reversible way

    Edit

    Just checked and Bleeping Computer have treated the NCH advertising system as a malware infection in the past

    Can't get rid of the dreaded NCH Software ...... - Am I infected? What do I do?

    so it can be a difficult task to Tame. It may be a good idea to create an account at Bleeping Computer and refer them to your issues (you should never follow instructions for malware removal that have been written for others, as they are always specific to the system concerned)
      My Computers

  2. dalchina's Avatar
    Posts : 30,035
    Win 10 Pro (1903)
       #12

    And there's even a Youtube video on removing Doxillion.. probably more..
    YouTube

    Some years ago I ended up removing references to some NCH software which were repeated for many file types.
      My Computers

  3. Steve C's Avatar
    Posts : 6,290
    Windows 10 Pro 64 bit
       #13

    Uninstall what you don't need then use Autoruns to check / disable third party stuff which loads on start up
      My Computers

  4. Barman58's Avatar
    Posts : 3,930
    Windows 10 Pro x64 2004 - 19041 - 264 XP/Vista/Win7/Win8.1 in VM for testing
       #14

    Steve C said:
    Uninstall what you don't need then use Autoruns to check / disable third party stuff which loads on startup
    Steve, Agree that this is the best under most situations of misbehaving application,

    This particular software is nasty as it, during an install, appears to go in and change the associations of standard file types to it's software, even those that are not installed. this needs to be reversed, preventing the small app loading that apparently loads giving the stated response to use one of their applications to complete a task itself will not reverse the changes that this Hijak has caused.

    If there is a suitable system restore point or file backup that could be used to return the system to what it was before the attack, but I think the situation really needs a specialist script or similar "reversal" system that Bleeping Computers are known for, and have already done in the past for this issue .
      My Computers

  5. dalchina's Avatar
    Posts : 30,035
    Win 10 Pro (1903)
       #15

    It also embeds lots of unexpected references to it in many places in the registry- just by installing 1 program.
      My Computers

  6. Barman58's Avatar
    Posts : 3,930
    Windows 10 Pro x64 2004 - 19041 - 264 XP/Vista/Win7/Win8.1 in VM for testing
       #16

    Undoubtedly, that's where the changes are located, the registry is the centralised store for that sort of setting.

    With the machine in front of me and a lot of time I could probably reverse the changes manually but a script to make multiple changes is beyond me, you would need to scan the registry and extract the settings for associations then change them to match what you really want.
      My Computers

  7. Try3's Avatar
    Posts : 7,462
    Windows 10 Home x64 Version 20H2 Build 19042.928
       #17

    Nigel,

    The script I posted undoes all the changes that concerned me. I can continue to use NCH WavePad without any annoying additions to my context menus.

    Denis
      My Computer

  8. Barman58's Avatar
    Posts : 3,930
    Windows 10 Pro x64 2004 - 19041 - 264 XP/Vista/Win7/Win8.1 in VM for testing
       #18

    Did you get a similar issue to @GarCooper where the system association for .DOC files has been changed the the hijack to Doxillion? or some similar hijack, or was it just the shortcuts and context menus changes
      My Computers

  9. Try3's Avatar
    Posts : 7,462
    Windows 10 Home x64 Version 20H2 Build 19042.928
       #19

    Nigel,

    Try3 said:
    You might also see NCH entries added to your context menu. Those can also be deleted fairly straightforwardly.
    - I've enclosed a .reg file that will remove the ones I have encountered.
    - You can examine the .reg file contents in Notepad before using it {just open Notepad then drag the .reg file into its window}.
    Attachment 264821

    Denis

    Try3 said:
    Now, when I try to edit a doc file by clicking on the filename in my directory program, l get a message telling me to run Doxillion if I want to edit the doc.
    This seems to indicate that you have installed this particular 'utility'. Please post a screenshot to help with assessment of the problem.

    Denis
    Denis
      My Computer

  10. Barman58's Avatar
    Posts : 3,930
    Windows 10 Pro x64 2004 - 19041 - 264 XP/Vista/Win7/Win8.1 in VM for testing
       #20

    @Try3

    Thanks Denis, it confirms what has been done and that these changes are in the registry, I've not got the free time to get hold of the Registry file and edit it, and even if I did it's knowing what to change them back to

    A registry or even a system backup from before the hijack would allow a recovery but I can't see any other way , unless something from Beeping computer can read and at least reset to defaults all the associations
      My Computers


 
Page 2 of 4 FirstFirst 1234 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 21:46.
Find Us




Windows 10 Forums