I just downloaded ImgBurn, another program that has OpenCandy in the installer. First I ran the installer normally, and saw the OpenCandy portion offering a 3rd-party program. Then I quit the installer, and then opened up a command prompt (using Run as Administrator), and ran the installer with the /NOCANDY switch, and never saw the OpenCandy portion offering any 3rd-party programs. So it seems the /NOCANDY switch does work.
There are a couple other ways to prevent OpenCandy from installing any 3rd-party programs, as mentioned in their FAQ:
* Beginner: disconnect your internet connection (beware some software needs the internet to complete its install) * Intermediate: run the OpenCandy powered installer from the command-line with /NOCANDY * Advanced: add a domain block in your firewall for *.opencandy.com
In addition, with ImgBurn there are a couple more options to install while avoiding OpenCandy. These options may or may not work with WinSCP or any other software that comes with OpenCandy:
1) Perform an NSIS silent installation using the following command (mentioned in this post):
SetupImgBurn_2.5.8.0.exe /S /D=C:\Program Files\ImgBurn
2) Use 7-Zip to open the installer and extract out the program files (mentioned in this post).
Additionally, some programs offer 2 versions of the installer - one with OpenCandy and one without. For example, CDBurnerXP does this, but when you go to their download page, it isn't immediately obvious that they have a version without OpenCandy. You have to click on "More download options" to see it.
Finally, if a program has a portable version, you can use that and you'll be sure to avoid OpenCandy, since portable versions don't have installers.