Solved Removing leftover bits of NCH software

[Raptor77]

Hi, I think I have something leftover from an uninstall and I'd prefer to get rid of whatever is left if possible please.

My CPU was consistently running at 50% when using audio programs (iTunes, VLC etc) and the culprit was the System Process. I later found out it was "stdriverx64.sys" specifically, and that it is associated with NCH software. As such I've attempted to remove those programs (via Control Panel). This has solved the CPU problem and all but two of the programs seem to have been removed successfully.

The remaining programs are "Prism Video File Converter" and "Express Zip". If I log in as Admin, these are NOT present in the Control Panel uninstall screen, however they are present when logged in as my usual user account (no admin rights). Clicking uninstall does not work: for Prism nothing happens, and for Express Zip I get the message "Access denied while deleted registry contents" followed by a reboot request which does not help. The same thing happens via CCleaner. I also tried a different third party uninstaller but it was also unable to help ("Best Uninstall Tool").

Is there a way I can get rid of these?

Thanks for any help!


OS: Windows 7 Home Premium 64bit + Service Pack 1

 

[Jacee]

Let's see if AdwCleaner finds and removes some of the 'left-overs'.

Download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

 

[Raptor77]

Let's see if AdwCleaner finds and removes some of the 'left-overs'.

Thanks for the reply. I don't think I can see anything about Prism or Express Zip in the text file but it's below anyway.

 

[Raptor77]

# AdwCleaner v2.200 - Logfile created 04/08/2013 at 21:14:01
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Admin - DESK1
# Boot Mode : Normal
# Running from : C:\Users\____\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : \END
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\OApps
Folder Deleted : C:\Users\Admin\AppData\Local\Conduit
Folder Deleted : C:\Users\Admin\AppData\Local\PackageAware
Folder Deleted : C:\Users\Admin\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16470

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\prefs.js

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4qndp34.default\user.js ... Deleted !

Deleted : user_pref("CT2801948.1000082.isPlayDisplay", "true");
Deleted : user_pref("CT2801948.1000082.state", "{\"state\":\"stopped\",\"text\":\"Virgin Ra...\",\"description[...]
Deleted : user_pref("CT2801948.1000234.TWC_TMP_city", "______");
Deleted : user_pref("CT2801948.1000234.TWC_TMP_country", "__");
Deleted : user_pref("CT2801948.1000234.TWC_locId", "________");
Deleted : user_pref("CT2801948.1000234.TWC_location", "______, ______________");
Deleted : user_pref("CT2801948.1000234.TWC_region", "__");
Deleted : user_pref("CT2801948.1000234.TWC_temp_dis", "c");
Deleted : user_pref("CT2801948.1000234.TWC_wind_dis", "mph");
Deleted : user_pref("CT2801948.1000234.weatherData", "{\"icon\":\"29.png\",\"temperature\":\"3°C\",\"temperatu[...]
Deleted : user_pref("CT2801948.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Deleted : user_pref("CT2801948.FirstTime", "true");
Deleted : user_pref("CT2801948.FirstTimeFF3", "true");
Deleted : user_pref("CT2801948.UserID", "UN08804325530044865");
Deleted : user_pref("CT2801948.addressBarTakeOverEnabledInHidden", "true");
Deleted : user_pref("CT2801948.autoDisableScopes", -1);
Deleted : user_pref("CT2801948.defaultSearch", "false");
Deleted : user_pref("CT2801948.embeddedsData", "[{\"appId\":\"129306881621438061\",\"apiPermissions\":{\"cross[...]
Deleted : user_pref("CT2801948.enableAlerts", "always");
Deleted : user_pref("CT2801948.enableSearchFromAddressBar", "true");
Deleted : user_pref("CT2801948.firstTimeDialogOpened", "true");
Deleted : user_pref("CT2801948.fixPageNotFoundError", "true");
Deleted : user_pref("CT2801948.fixPageNotFoundErrorInHidden", "true");
Deleted : user_pref("CT2801948.fixUrls", true);
Deleted : user_pref("CT2801948.hxxp___pinterest_aot_im.isEnabled", "Y");
Deleted : user_pref("CT2801948.installId", "ConduitInstaller.exe");
Deleted : user_pref("CT2801948.installType", "ConduitNSISIntegration");
Deleted : user_pref("CT2801948.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.isNewTabEnabled", true);
Deleted : user_pref("CT2801948.isPerformedSmartBarTransition", "true");
Deleted : user_pref("CT2801948.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Deleted : user_pref("CT2801948.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"file%[...]
Deleted : user_pref("CT2801948.openThankYouPage", "false");
Deleted : user_pref("CT2801948.openUninstallPage", "true");
Deleted : user_pref("CT2801948.search.searchAppId", "129306881621438061");
Deleted : user_pref("CT2801948.search.searchCount", "0");
Deleted : user_pref("CT2801948.searchInNewTabEnabledInHidden", "true");
Deleted : user_pref("CT2801948.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT2801948.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Deleted : user_pref("CT2801948.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"3\[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT2801948.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Deleted : user_pref("CT2801948.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1345797620751");
Deleted : user_pref("CT2801948.serviceLayer_services_appsMetadata_lastUpdate", "1345797620660");
Deleted : user_pref("CT2801948.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1345797621147");
Deleted : user_pref("CT2801948.serviceLayer_services_login_10.10.22.13_lastUpdate", "1345797621524");
Deleted : user_pref("CT2801948.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1345797621207");
Deleted : user_pref("CT2801948.serviceLayer_services_searchAPI_lastUpdate", "1345797620362");
Deleted : user_pref("CT2801948.serviceLayer_services_serviceMap_lastUpdate", "1345797619876");
Deleted : user_pref("CT2801948.serviceLayer_services_toolbarContextMenu_lastUpdate", "1345797621191");
Deleted : user_pref("CT2801948.serviceLayer_services_toolbarSettings_lastUpdate", "1345797620327");
Deleted : user_pref("CT2801948.serviceLayer_services_translation_lastUpdate", "1345797620651");
Deleted : user_pref("CT2801948.settingsINI", true);
Deleted : user_pref("CT2801948.shouldFirstTimeDialog", "false");
Deleted : user_pref("CT2801948.smartbar.CTID", "CT2801948");
Deleted : user_pref("CT2801948.smartbar.Uninstall", "0");
Deleted : user_pref("CT2801948.smartbar.toolbarName", "NCH EN ");
Deleted : user_pref("CT2801948.startPage", "false");
Deleted : user_pref("CT2801948.toolbarBornServerTime", "24-8-2012");
Deleted : user_pref("CT2801948.toolbarCurrentServerTime", "24-8-2012");
Deleted : user_pref("CT2801948.twitter_v1.8.0_twitter_app_open_t_f", "false");

File : C:\Users\___\AppData\Roaming\Mozilla\Firefox\Profiles\uhxy54oq.default\prefs.js

Deleted : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,en-GB%40dictionaries.addon[...]

*************************

AdwCleaner[S1].txt - [7834 octets] - [08/04/2013 21:14:01]

########## EOF - \AdwCleaner[S1].txt - [7894 octets] ##########

 

[Jacee]

Looks like it deleted the 'toolbar', plus a bunch of other bundled foistware!

Deleted : user_pref("CT2801948.smartbar.toolbarName", "NCH EN ");

Now navigate to C:\Users\[YourUserName]\AppData\Roaming <--- and delete the NCH Vision folder.

 

[Raptor77]

Looks like it deleted the 'toolbar', plus a bunch of other bundled foistware!

Deleted : user_pref("CT2801948.smartbar.toolbarName", "NCH EN ");

Now navigate to C:\Users\[YourUserName]\AppData\Roaming <--- and delete the NCH Vision folder.

Ah yeah I missed that one. And yay for deleting other unwanteds

The NCH folder in Roaming is actually "NCH Software" - should I still just delete it? Looks like it contains the Prism/Express Zip exe's and dll's etc.

 

[Jacee]

Yes, just delete it.

If it won't delet in 'normal' mode .. go into safe mode (so it's not running) and delete the entire folder.

 

[ZomBob]

Seriously well done sir. I have to say that for a free community forum this is one of the more helpful I have encountered. Kudos.

 

[Jacee]

Thank you ZomBob, but I'm a 'she'... not a 'sir'

 

[Raptor77]

Yes, just delete it.

If it won't delet in 'normal' mode .. go into safe mode (so it's not running) and delete the entire folder.

Done - didn't require safe mode. They still showed up in Control Panel but clicking uninstall gave a message saying "It may have already been uninstalled" and I clicked to remove the names from CP anyway.

And to echo ZomBob, this forum is very impressive for help (it's not the first time I've come here with a PC problem). Thanks so much for this, Jacee!

I'll mark as solved and leave rep.

 

[ZomBob]

Well played mam, well played.

 

[rick486]

Total Removal of NCH software

Am having freezes with Win 7 and began looking for unwanted/suspicious software. Saw NCH Software Icon on my desktop and don't know how or when it got there. Looked in Control Panel>>Uninstall for NCH and it's NOWHERE. Went to C:\Program Files (x86) and there it was. Went into sub folders and began deleting and all but two files/folders would not delete. Sooo....decided to delete all references to NCH in the Registry.

Go to Start>>Run>>"regedit" (type in), click OK, then RUN ....the Registry Editor opens. Now for the initiated, deleting stuff from the registry seems daunting, but I've deleted JUNK stuff from it all the time, you just have to be selective in deleting ONLY what you're searching for. Here's what you do for NCH residue:

1. Go to Edit>>Find window and type in: "NCH Software" without parenthesis. Click "Find Next" and the first of approximately 50 garbage entries of NCH will appear. Now pay attention to the following:

2. The highlighted entry will always be in the RIGHT box. If there is NO REFERENCE to "NCH..." in the left box, then just delete the RIGHT BOX line. To go to the next entry easily, just hit the "F3" key. Now:

3. If there is any "NCH..." or "expresszip" in the LEFT BOX (the main registry headings), then HIGHLIGHT THATand hit DELETE and it plus the entire subset will be deleted, which is what you want.

BE CAREFUL!!! IT'S EASY TO GET CARRIED AWAY WITH THE DELETE--F3 KEYS AND GET CARELESS. DO NOT DELETE AN ENTRY LIKE "NCx" where x is another letter.

Once you've scanned your entire directory, move the "elevator" up to the top, highlight "C:\" and rescan to make sure you didn't miss one.

Now close the Registry and your changes will be saved. Reboot your computer and find the folder "NEH Software" in the "Program Files (x86" (Win 7) section using Windows explorer, or "computer" in the Start screen. Highlight the NCH folder and hit DELETE. It may ask you to continue as an administrator, so do so. The NCH folder and all files will be deleted.

Time will tell if that was the culprit in my freezes.