Removing leftover bits of NCH software

Hi, I think I have something leftover from an uninstall and I'd prefer to get rid of whatever is left if possible please.

My CPU was consistently running at 50% when using audio programs (iTunes, VLC etc) and the culprit was the System Process. I later found out it was "stdriverx64.sys" specifically, and that it is associated with NCH software. As such I've attempted to remove those programs (via Control Panel). This has solved the CPU problem and all but two of the programs seem to have been removed successfully.

The remaining programs are "Prism Video File Converter" and "Express Zip". If I log in as Admin, these are NOT present in the Control Panel uninstall screen, however they are present when logged in as my usual user account (no admin rights). Clicking uninstall does not work: for Prism nothing happens, and for Express Zip I get the message "Access denied while deleted registry contents" followed by a reboot request which does not help. The same thing happens via CCleaner. I also tried a different third party uninstaller but it was also unable to help ("Best Uninstall Tool").

Is there a way I can get rid of these?

Thanks for any help!


OS: Windows 7 Home Premium 64bit + Service Pack 1

Jacee said:

Let's see if AdwCleaner finds and removes some of the 'left-overs'.

Thanks for the reply. I don't think I can see anything about Prism or Express Zip in the text file but it's below anyway.

# AdwCleaner v2.200 - Logfile created 04/08/2013 at 21:14:01
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Admin - DESK1
# Boot Mode : Normal
# Running from : C:\Users\____\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : \END
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\OApps
Folder Deleted : C:\Users\Admin\AppData\Local\Conduit
Folder Deleted : C:\Users\Admin\AppData\Local\PackageAware
Folder Deleted : C:\Users\Admin\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16470

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\prefs.js

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\user.js ... Deleted !

Deleted : user_pref("CT2801948.1000082.isPlayDisplay", "true");
Deleted : user_pref("CT2801948.1000082.state", "{\"state\":\"stopped\",\"text\":\"Virgin Ra...\",\"description[...]
Deleted : user_pref("CT2801948.1000234.TWC_TMP_city", "______");
Deleted : user_pref("CT2801948.1000234.TWC_TMP_country", "__");
Deleted : user_pref("CT2801948.1000234.TWC_locId", "________");
Deleted : user_pref("CT2801948.1000234.TWC_location", "______, ______________");
Deleted : user_pref("CT2801948.1000234.TWC_region", "__");
Deleted : user_pref("CT2801948.1000234.TWC_temp_dis", "c");
Deleted : user_pref("CT2801948.1000234.TWC_wind_dis", "mph");
Deleted : user_pref("CT2801948.1000234.weatherData", "{\"icon\":\"29.png\",\"temperature\":\"3°C\",\"temperatu[...]
Deleted : user_pref("CT2801948.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Deleted : user_pref("CT2801948.FirstTime", "true");
Deleted : user_pref("CT2801948.FirstTimeFF3", "true");
Deleted : user_pref("CT2801948.UserID", "UN08804325530044865");
Deleted : user_pref("CT2801948.addressBarTakeOverEnabledInHidden", "true");
Deleted : user_pref("CT2801948.autoDisableScopes", -1);
Deleted : user_pref("CT2801948.defaultSearch", "false");
Deleted : user_pref("CT2801948.embeddedsData", "[{\"appId\":\"129306881621438061\",\"apiPermissions\":{\"cross[...]
Deleted : user_pref("CT2801948.enableAlerts", "always");
Deleted : user_pref("CT2801948.enableSearchFromAddressBar", "true");
Deleted : user_pref("CT2801948.firstTimeDialogOpened", "true");
Deleted : user_pref("CT2801948.fixPageNotFoundError", "true");
Deleted : user_pref("CT2801948.fixPageNotFoundErrorInHidden", "true");
Deleted : user_pref("CT2801948.fixUrls", true);
Deleted : user_pref("CT2801948.hxxp___pinterest_aot_im.isEnabled", "Y");
Deleted : user_pref("CT2801948.installId", "ConduitInstaller.exe");
Deleted : user_pref("CT2801948.installType", "ConduitNSISIntegration");
Deleted : user_pref("CT2801948.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.isNewTabEnabled", true);
Deleted : user_pref("CT2801948.isPerformedSmartBarTransition", "true");
Deleted : user_pref("CT2801948.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Deleted : user_pref("CT2801948.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"file%[...]
Deleted : user_pref("CT2801948.openThankYouPage", "false");
Deleted : user_pref("CT2801948.openUninstallPage", "true");
Deleted : user_pref("CT2801948.search.searchAppId", "129306881621438061");
Deleted : user_pref("CT2801948.search.searchCount", "0");
Deleted : user_pref("CT2801948.searchInNewTabEnabledInHidden", "true");
Deleted : user_pref("CT2801948.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Deleted : user_pref("CT2801948.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"3\[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Deleted : user_pref("CT2801948.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1345797620751");
Deleted : user_pref("CT2801948.serviceLayer_services_appsMetadata_lastUpdate", "1345797620660");
Deleted : user_pref("CT2801948.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1345797621147");
Deleted : user_pref("CT2801948.serviceLayer_services_login_10.10.22.13_lastUpdate", "1345797621524");
Deleted : user_pref("CT2801948.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1345797621207");
Deleted : user_pref("CT2801948.serviceLayer_services_searchAPI_lastUpdate", "1345797620362");
Deleted : user_pref("CT2801948.serviceLayer_services_serviceMap_lastUpdate", "1345797619876");
Deleted : user_pref("CT2801948.serviceLayer_services_toolbarContextMenu_lastUpdate", "1345797621191");
Deleted : user_pref("CT2801948.serviceLayer_services_toolbarSettings_lastUpdate", "1345797620327");
Deleted : user_pref("CT2801948.serviceLayer_services_translation_lastUpdate", "1345797620651");
Deleted : user_pref("CT2801948.settingsINI", true);
Deleted : user_pref("CT2801948.shouldFirstTimeDialog", "false");
Deleted : user_pref("CT2801948.smartbar.CTID", "CT2801948");
Deleted : user_pref("CT2801948.smartbar.Uninstall", "0");
Deleted : user_pref("CT2801948.smartbar.toolbarName", "NCH EN ");
Deleted : user_pref("CT2801948.startPage", "false");
Deleted : user_pref("CT2801948.toolbarBornServerTime", "24-8-2012");
Deleted : user_pref("CT2801948.toolbarCurrentServerTime", "24-8-2012");
Deleted : user_pref("CT2801948.twitter_v1.8.0_twitter_app_open_t_f", "false");

File : C:\Users\___\AppData\Roaming\Mozilla\Firefox\Profiles\uhxy54oq.default\prefs.js

Deleted : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,en-GB%40dictionaries.addon[...]

*************************

AdwCleaner[S1].txt - [7834 octets] - [08/04/2013 21:14:01]

########## EOF - \AdwCleaner[S1].txt - [7894 octets] ##########

Jacee said:

Looks like it deleted the 'toolbar', plus a bunch of other bundled foistware!

Deleted : user_pref("CT2801948.smartbar.toolbarName", "NCH EN ");

Now navigate to C:\Users\[YourUserName]\AppData\Roaming <--- and delete the NCH Vision folder.

Ah yeah I missed that one. And yay for deleting other unwanteds :)

The NCH folder in Roaming is actually "NCH Software" - should I still just delete it? Looks like it contains the Prism/Express Zip exe's and dll's etc.

Seriously well done sir. I have to say that for a free community forum this is one of the more helpful I have encountered. Kudos.

Jacee said:

Yes, just delete it. :)

If it won't delet in 'normal' mode .. go into safe mode (so it's not running) and delete the entire folder.

Done - didn't require safe mode. They still showed up in Control Panel but clicking uninstall gave a message saying "It may have already been uninstalled" and I clicked to remove the names from CP anyway.

And to echo ZomBob, this forum is very impressive for help (it's not the first time I've come here with a PC problem). Thanks so much for this, Jacee!

I'll mark as solved and leave rep.