NSIS Media Remover

I’ve assembled everything I’ve learned the past few weeks about NSIS Media into one simple and effortless application that should completely remove it. NSIS Media Remover removes installed files and registry keys.

  • 93 101 known DLL files installed into the system folder
  • C:Program FilesCommon FilesNSIS folder
  • Firefox nsis.jar extension
  • Many registry keys
    • CLSIDs
    • Shell extensions
    • txtfile context menu handler
    • Overlay icon handlers
    • SoftwareNSISMedia
    • SoftwareIAN
    • Add/Remove entry

NSIS Media Remover is provided without any warranty. Its source code is available in the tool itself. Hit the View Source Code button to get it.

Download NSIS Media Remover

md5:  7778c19e9df725d20a30fe42f425589d
sha1: 9eb42afbf75fd97555cc5260b3d24f33a6dec622

While creating this tool, I’ve found more exciting new facts about this pest. One of which is that apparently, CNET were fooled into serving the downloads on download.com. The installers check to see if the computer belongs to download sites, anti-virus companies and even Cydoor prior to installing the pest.

Update: version 1.1 was released on January 13th, 2007 with 8 more files missed in the original research.

71 thoughts on “NSIS Media Remover

  1. Found a link at the end of a discussion of this NSIS scourge. After reading I speculate that I got this NSIS nightmare from installing Turbo Torrent. Spybot search & destroy continually removed it, an it has just reinstalled everytime. The symptoms were that Firefox continually lagged, jumping when I tried to scroll, and tons of ping requests and port blocks blocked by my firewall. It was getting so bad I could hardly do anything without a block popping up. Those blasted ads as well. I manually deleted lots of files according to the forums, but to no avail. After running your NSIS media remover all is silent. Scrolling is smooth. I removed Turbo Torrent and I hope never to run into this problem again. What I do hope is to find who is behind this. It might be useful to block all websites related to these evil-doers by adding their IP’s to a blocklist either in peer guardian or in some other fashion. My Symantec antivirus found nothing, Adaware found nothing, Spybot could not adequately cope with it and I pulled out all my hair except 1.
    Thank you is hardly adequate, but all I have before my children and ex-wife emptied my bank account this Xmas. You are extraordinarily intelligent to have figured this out. Thank you thank you thank you!

  2. Just ran your anti-NSIS Media prog. So far, so good!
    Was about to go in search of a commercial prog. to try and get rid of this evil crap. Your solution seems to be working. Thank You, Thank You, Thank You!!!!

  3. An evil piece of work, I think I got with turbo torrent as well,
    For the first time in weeks I,ll sleep soundly
    thank you

  4. Oh… Thank you so much for your time for creating this so useful tool!

    I’ve been trying to get rid of NSIS with Spybot & with Spyware Terminator but nada!

    Thank you have a merry Xmas and Happy New Year! 🙂

  5. I just wanted to say a big thankyou for this programme! I have spent the last hour or so scanning the web looking for instructions on how to remove this … and then I found your website and I am soooo grateful! Computer even seems to be faster now!

    Your time and effort is so appreciated!

    Once again, many thanks and Merry Christmas!


  6. Thank you thank you thank you!

    Can’t believe Symantec have had at least 5-6 months to figure out how to remove NSIS and still antivirus doesn’t even pick up on its presence!

  7. Thank you ! I got NSIS Media when installing Startup Mechanics and lost two hours trying removing it, before I found your program. It worked perfectly !

  8. WOW….that was my first reaction,,,i have looked everywhere to get rid of this horrible nsis trojan and in my search came across your remover,,,hey thankyou soooo much,your a genius,,,please for everyones sake enter your remover in sites like http://www.downloads.com etc thankyou so much and keep up the good work 🙂

  9. Thanks a lot for this highly useful tiny cleanup utility. I tried manual removal, Spybot and McAfee Spyware removal program none of them we able to remove this complete. Your program did succeed though. I removed Turbo Torrent and I will never install this or any other program from download.com

    Thank you very much one again.

  10. It DOESN’T WORK with me
    It remove that folder an its compoments but the samepop up reappear again and again

    +++PLEASE HELP+++

  11. Brummelchen, welcome.ini is already extracted to the source code folder and no other files are required. If UPX gives you problems, simply remove the !packhdr line.

  12. I still did not know where this stuff comes from!
    I did not install ANYTHING the last 3 days! The only thing i found out that only your tool was able to remove it completely! Spybot S&D missed a dll!

    Thanks for that! You are my monthly hero 😉

    PS: A Question to you! My English is not very good, so i did not understand everything what your were writing about that stuff! What has CCCleaner to do with that? You mentioned it somewhere on your side!

  13. Ah yes,

    i forgot to mention that i found throughout my registry searches that there was a short time a nsis.jar on my pc! So it seems that somehow Firefox was not able to block some script! Althoug im using the no-script addon from Firefox i allowed Java, because im writing sometimes small java-applets.

    Thanks again!

  14. Liv, I mentioned CCleaner as an application that got ripped off by Foxie. CCleaner doesn’t contain NSIS Media, it was just another victim of it.

  15. Thankyou very much for this little utility. I only became infested with this nasty NSISMedia thing today and at first i thought it was a glitch but then it got worse as the day wore on. I found this utility from the CCleaner forums. Funny how my £50 Norton 2006 didn’t detect this and get rid of it, but your utility did it for free. You sir, are my hero of the hour. *tips hat.


  16. A thousand thanks for this! Installed and it worked first time. No more nasty unwanted pop-up adverts. Thank you so much for giving me a happy peaceful PC!

  17. Was a bit skeptical at first to run this remover program but was desperate to get rid of the annoying ad pop-up. Worked the first time. Thanks, my PC is back to normal.

  18. didn’t work…have tried this a bunch of times…still getting the popups…i think it is starting to mess up my programs…

  19. Josh, did you reboot after running the remover? If so, contact me using the Contact page with more details, including the output of the remover.

  20. Thanks alot!
    I have updated zonalaram spyware and bitdefender byt neither of them could find them!

    What a spyware it is !!!

    I wish you best and wish someone pay you for that!
    thanx again

  21. Wow…I’ve been trying to get rid of this forever. Just rebooted and it’s not showing in add/remove programs (hope it stays off). Thanks!
    Thanks also to Paul (PicAFlic)…your comments in the Mozilla forum and your website were great help!

  22. Dear Kichik,

    My PC has been infected by NSIS Media for the past several month and I have done a lot of things to remove NSIS Media. Last thing I did was moving from Firefox to Opera, because it looks like Opera is the only browser that able to block NSIS Media…..

    Last night, I have to use my Firefox again to view a web site that is not viewed right with Opera. And NSIS pop up again ! I try to search the web again for a new fix of NSIS, and I found your page. I read, study, download, and do virus scan. Then I run your “NSIS Media Remover”. It found some files, deleted some instantly, and mark some files for deletion after reboot.

    Then I reboot.

    After reboot I tried to run NSIS Media Remover for the second time, and NSIS was not found. Then I tried to run Firefox for sometime, no NSIS POPUP !! and then I leave Firefox running while I sleep. The next morning I checked my screen, also no sign of the NSIS popup !!!

    Wow – this freeware is genius !!! Terima kasih banyak !!! (it’s Indonesian language, meaning : Thank you very much !!!)

    Warm regards,

  23. Thanks! Reading your blogs has made me feel a little better about infecting myself with the nsis malware. I am generally quite cautious; run regular ad aware scans, virus check all executables before launching and try my best to stick to “trusted” sources for software.

    I had manually removed nsis from the registry and mozilla while adaware found its stub in windowssystem32. I used your scan and it happily found the residual bits & pieces. I’ve suggested my friends run your scan just to make sure they’re safe too.

  24. Your small but highly gifted tool blame the ignorant and incapable maker of antivirus and antispyware programs like Lavasoft and F-Secure Corporation. They got a lot of money from me but their programs don´t work well. Questions they don´t answer or they tell nonsense…

    Thank you very much for your work.
    Best regards from the Rhine river


  25. Found you from the message boards at Mozilla. They should put your fix up front! Worked great.

  26. To thank you is simply not possible, it would be far to inadiquit. You are far better then probebly anyone, anyware… I hope you have a fantastic life!!!


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.