How Block Unwanted Software From Starting

GarCooper said:

Windows 10 Version 1903

NCH Software seems to have installed 28 of their programs on my PC. There is a directory showing shortcuts to them, including one called Doxillion.

Now, when I try to edit a doc file by clicking on the filename in my directory program, l get a message telling me to run Doxillion if I want to edit the doc.

None of the NCH programs are listed in the installed apps in Windows Settings, so I can't uninstall.

How do I block or uninstall the NCH stuff?

Thanks.

Every filetype DOC, Txt, JPG, etc has a default application that is set to open or otherwise work with the file type - It would appear that NCH have changed the Default for some of the standard file types to run a program that just "suggests" you use their program Without loading the full program this is behaviour which is close to a Malware attack, not something that you expect from a legitimate company.

However, there is an entry in each filetype that sets this association "File type to Application" if you right click on a file of the type that is being Hijacked eg DOC there is a en entry "Opens With ... " you should be able to set that to whatever you want to open your files with.

I would personally look at your system using Microsoft's Autoruns which lists every item that starts when windows does this could be used to block any programs by NCH from loading, (the basic usage is to uncheck a checkbox next to each item that is set to run on system startup), It can be a little intimidating as the amount of items that load with windows is huge. Careful use can however sort issues in a reversible way

Edit

Just checked and Bleeping Computer have treated the NCH advertising system as a malware infection in the past

Can't get rid of the dreaded NCH Software ...... - Am I infected? What do I do?

so it can be a difficult task to Tame. It may be a good idea to create an account at Bleeping Computer and refer them to your issues (you should never follow instructions for malware removal that have been written for others, as they are always specific to the system concerned)

And there's even a Youtube video on removing Doxillion.. probably more..
YouTube

Some years ago I ended up removing references to some NCH software which were repeated for many file types.

Steve C said:

Uninstall what you don't need then use Autoruns to check / disable third party stuff which loads on startup

Steve, Agree that this is the best under most situations of misbehaving application,

This particular software is nasty as it, during an install, appears to go in and change the associations of standard file types to it's software, even those that are not installed. this needs to be reversed, preventing the small app loading that apparently loads giving the stated response to use one of their applications to complete a task itself will not reverse the changes that this Hijak has caused.

If there is a suitable system restore point or file backup that could be used to return the system to what it was before the attack, but I think the situation really needs a specialist script or similar "reversal" system that Bleeping Computers are known for, and have already done in the past for this issue .

It also embeds lots of unexpected references to it in many places in the registry- just by installing 1 program.

Undoubtedly, that's where the changes are located, the registry is the centralised store for that sort of setting.

With the machine in front of me and a lot of time I could probably reverse the changes manually but a script to make multiple changes is beyond me, you would need to scan the registry and extract the settings for associations then change them to match what you really want.

Nigel,

The script I posted undoes all the changes that concerned me. I can continue to use NCH WavePad without any annoying additions to my context menus.

Denis

Did you get a similar issue to @GarCooper where the system association for .DOC files has been changed the the hijack to Doxillion? or some similar hijack, or was it just the shortcuts and context menus changes

Nigel,

Try3 said:

You might also see NCH entries added to your context menu. Those can also be deleted fairly straightforwardly.
- I've enclosed a .reg file that will remove the ones I have encountered.
- You can examine the .reg file contents in Notepad before using it {just open Notepad then drag the .reg file into its window}.
Attachment 264821

Denis

Try3 said:

Now, when I try to edit a doc file by clicking on the filename in my directory program, l get a message telling me to run Doxillion if I want to edit the doc.

This seems to indicate that you have installed this particular 'utility'. Please post a screenshot to help with assessment of the problem.

Denis

Denis

@Try3

Thanks Denis, it confirms what has been done and that these changes are in the registry, I've not got the free time to get hold of the Registry file and edit it, and even if I did it's knowing what to change them back to

A registry or even a system backup from before the hijack would allow a recovery but I can't see any other way , unless something from Beeping computer can read and at least reset to defaults all the associations