Some (many) years ago, their Prism converter was good. Now they use their website to hack your computer - or so it seems. I simply updated what I had installed from them (Prism) and then decided to browse through the options...And there was the "TOOLBOX" with very short descriptions of what it supposed to offer.
I clicked few links - nothing told me that I am installing applications. A bit later, while I was searching the web, a window comes up asking if I want to change my default searcg engine. I answered "NO" - and shortly after that I see a whole bunch of photoediting, sound-conversion, slide who and hell know what else installed on my computer.
To top it off – the home page of both browsers I use changed to NCH, the Google Toolbar was replaced with something from NCH – of course, without anyone asking my permission. And that is with antivirus running.
When I tried to uninstall the unwanted software using Windows Control Panel, the programs refused to uninstall, informing that I should finish the previuos "installation". (probably, another malicious code did not finish running by the time I switched off the internet connection just in case).
I removed the NCH add-on in Firefox, changed the home page back to what it was – but when I restart Firefox, everything is back – which means the NCH gadgets and their home page. I had better luck with Explorer – there it cleaned up the NCH from the first try.
Now back to uninstalling. I found the NCH folder and in the subfolders there (some 5 or 7 of them) were separate uninstallers for each one of their wonderful programs. Just one of them worked – the rest asked you for a feedback, tell you that all is uninstalled – and nothing changed. So I cleaned the registry with
regedit – searching for "NCH Software" and other names in their folders and deleting each one of them. Still did not fix the Firefox.
Now I have to run a deep virus scan and perhaps, restore the system to some previous points.