I’ve assembled everything I’ve learned the past few weeks about NSIS Media into one simple and effortless application that should completely remove it. NSIS Media Remover removes installed files and registry keys.
- 93 101 known DLL files installed into the system folder
- C:Program FilesCommon FilesNSIS folder
- Firefox nsis.jar extension
- Many registry keys
- CLSIDs
- Shell extensions
- txtfile context menu handler
- Overlay icon handlers
- SoftwareNSISMedia
- SoftwareIAN
- Add/Remove entry
NSIS Media Remover is provided without any warranty. Its source code is available in the tool itself. Hit the View Source Code button to get it.
md5: 7778c19e9df725d20a30fe42f425589d
sha1: 9eb42afbf75fd97555cc5260b3d24f33a6dec622
While creating this tool, I’ve found more exciting new facts about this pest. One of which is that apparently, CNET were fooled into serving the downloads on download.com. The installers check to see if the computer belongs to download sites, anti-virus companies and even Cydoor prior to installing the pest.
Update: version 1.1 was released on January 13th, 2007 with 8 more files missed in the original research.
kichik's blog 
Wow so far this little app worked perfectly! Thanks a bunch!
Thanks for this, it worked great! Going to direct people here.
Thanks. Everything seems to be running smooth. Plus the background info you have dug up really helped.
Found a link at the end of a discussion of this NSIS scourge. After reading I speculate that I got this NSIS nightmare from installing Turbo Torrent. Spybot search & destroy continually removed it, an it has just reinstalled everytime. The symptoms were that Firefox continually lagged, jumping when I tried to scroll, and tons of ping requests and port blocks blocked by my firewall. It was getting so bad I could hardly do anything without a block popping up. Those blasted ads as well. I manually deleted lots of files according to the forums, but to no avail. After running your NSIS media remover all is silent. Scrolling is smooth. I removed Turbo Torrent and I hope never to run into this problem again. What I do hope is to find who is behind this. It might be useful to block all websites related to these evil-doers by adding their IP’s to a blocklist either in peer guardian or in some other fashion. My Symantec antivirus found nothing, Adaware found nothing, Spybot could not adequately cope with it and I pulled out all my hair except 1.
Thank you is hardly adequate, but all I have before my children and ex-wife emptied my bank account this Xmas. You are extraordinarily intelligent to have figured this out. Thank you thank you thank you!
Hello,
It’s about some time that someone made a NSIS Media Remover. I bet you’ve heard that I made the following site: http://www.freewebs.com/picaflic and that I am one of the first people to find a way to remove the NSIS Media Worm be downloading TrojanHunter. Well, I did put your site on my page. I hope this tool helps everyone!
Just ran your anti-NSIS Media prog. So far, so good!
Was about to go in search of a commercial prog. to try and get rid of this evil crap. Your solution seems to be working. Thank You, Thank You, Thank You!!!!
An evil piece of work, I think I got with turbo torrent as well,
For the first time in weeks I,ll sleep soundly
thank you
Thank you much! I think mine came from turbo turrent , too. Keep up the great work!
This killed NSIS completely! I am very grateful for your hard work and patience killing this nuiscence!
Oh… Thank you so much for your time for creating this so useful tool!
I’ve been trying to get rid of NSIS with Spybot & with Spyware Terminator but nada!
Thank you have a merry Xmas and Happy New Year! 🙂
I just wanted to say a big thankyou for this programme! I have spent the last hour or so scanning the web looking for instructions on how to remove this … and then I found your website and I am soooo grateful! Computer even seems to be faster now!
Your time and effort is so appreciated!
Once again, many thanks and Merry Christmas!
Jayne
Used the remover and it seemed to work.
Thanks greatly for all the effort you put into it.
Thank you thank you thank you!
Can’t believe Symantec have had at least 5-6 months to figure out how to remove NSIS and still antivirus doesn’t even pick up on its presence!
Thank you ! I got NSIS Media when installing Startup Mechanics and lost two hours trying removing it, before I found your program. It worked perfectly !
You are a godsend,thanks a lot kichik
WOW….that was my first reaction,,,i have looked everywhere to get rid of this horrible nsis trojan and in my search came across your remover,,,hey thankyou soooo much,your a genius,,,please for everyones sake enter your remover in sites like http://www.downloads.com etc thankyou so much and keep up the good work 🙂
Thanks a lot for this highly useful tiny cleanup utility. I tried manual removal, Spybot and McAfee Spyware removal program none of them we able to remove this complete. Your program did succeed though. I removed Turbo Torrent and I will never install this or any other program from download.com
Thank you very much one again.
It DOESN’T WORK with me
It remove that folder an its compoments but the samepop up reappear again and again
+++PLEASE HELP+++
wow, thanx so much. I was looking soo long for you to give me the solution. keep doing nice work
DOM, please contact me by e-mail with more details. You can use the Contact page.
Pls add the welcome.ini and other missing fils to the remover. cheers.
Brummelchen, welcome.ini is already extracted to the source code folder and no other files are required. If UPX gives you problems, simply remove the !packhdr line.
[…] I’ve updated my NSIS Media Remover to detect and remove those as well. I’ve also updated the samples archive, though it still doesn’t contain any of the old version DLL files. […]
it didnt work. the files are still there, but ill try it in safe mode now to see if that helps, this is SUCH apest. btw, whats the “source doe” for?
Weston Clark, did you reboot? Which files? The source code is there so you can see what it does.
I still did not know where this stuff comes from!
I did not install ANYTHING the last 3 days! The only thing i found out that only your tool was able to remove it completely! Spybot S&D missed a dll!
Thanks for that! You are my monthly hero 😉
PS: A Question to you! My English is not very good, so i did not understand everything what your were writing about that stuff! What has CCCleaner to do with that? You mentioned it somewhere on your side!
Ah yes,
i forgot to mention that i found throughout my registry searches that there was a short time a nsis.jar on my pc! So it seems that somehow Firefox was not able to block some script! Althoug im using the no-script addon from Firefox i allowed Java, because im writing sometimes small java-applets.
Thanks again!
Liv, I mentioned CCleaner as an application that got ripped off by Foxie. CCleaner doesn’t contain NSIS Media, it was just another victim of it.
can’t thank you enough for the remover. i hope those responsible rot in hell!
Thankyou very much for this little utility. I only became infested with this nasty NSISMedia thing today and at first i thought it was a glitch but then it got worse as the day wore on. I found this utility from the CCleaner forums. Funny how my £50 Norton 2006 didn’t detect this and get rid of it, but your utility did it for free. You sir, are my hero of the hour. *tips hat.
Thankyou!
Thank you so much. So far, your program has worked like a charm!
A thousand thanks for this! Installed and it worked first time. No more nasty unwanted pop-up adverts. Thank you so much for giving me a happy peaceful PC!
Dan
Was a bit skeptical at first to run this remover program but was desperate to get rid of the annoying ad pop-up. Worked the first time. Thanks, my PC is back to normal.
Thank-you so much, tried 10 other “recommendations” before using this, one click and it was gone. Thanks!!!!
Dude! Thank you! worked like a charm. chewed that NSIS jerk up and spit him out! very niiiiyce.
Seems to be working so far… You’re awesome for making this.
didn’t work…have tried this a bunch of times…still getting the popups…i think it is starting to mess up my programs…
Josh, did you reboot after running the remover? If so, contact me using the Contact page with more details, including the output of the remover.
Thanks alot!
I have updated zonalaram spyware and bitdefender byt neither of them could find them!
What a spyware it is !!!
I wish you best and wish someone pay you for that!
thanx again
Best tool ever. xoxo
Awesome! Thanks a lot!!
Thanks man…you got skills…
Wow…I’ve been trying to get rid of this forever. Just rebooted and it’s not showing in add/remove programs (hope it stays off). Thanks!
Thanks also to Paul (PicAFlic)…your comments in the Mozilla forum and your website were great help!
John
Dear Kichik,
My PC has been infected by NSIS Media for the past several month and I have done a lot of things to remove NSIS Media. Last thing I did was moving from Firefox to Opera, because it looks like Opera is the only browser that able to block NSIS Media…..
Last night, I have to use my Firefox again to view a web site that is not viewed right with Opera. And NSIS pop up again ! I try to search the web again for a new fix of NSIS, and I found your page. I read, study, download, and do virus scan. Then I run your “NSIS Media Remover”. It found some files, deleted some instantly, and mark some files for deletion after reboot.
Then I reboot.
After reboot I tried to run NSIS Media Remover for the second time, and NSIS was not found. Then I tried to run Firefox for sometime, no NSIS POPUP !! and then I leave Firefox running while I sleep. The next morning I checked my screen, also no sign of the NSIS popup !!!
Wow – this freeware is genius !!! Terima kasih banyak !!! (it’s Indonesian language, meaning : Thank you very much !!!)
Warm regards,
Hartono
Thanks! Reading your blogs has made me feel a little better about infecting myself with the nsis malware. I am generally quite cautious; run regular ad aware scans, virus check all executables before launching and try my best to stick to “trusted” sources for software.
I had manually removed nsis from the registry and mozilla while adaware found its stub in windowssystem32. I used your scan and it happily found the residual bits & pieces. I’ve suggested my friends run your scan just to make sure they’re safe too.
Your small but highly gifted tool blame the ignorant and incapable maker of antivirus and antispyware programs like Lavasoft and F-Secure Corporation. They got a lot of money from me but their programs don´t work well. Questions they don´t answer or they tell nonsense…
Thank you very much for your work.
Best regards from the Rhine river
Manfred
Thank-you
Thank-you
Thank-you
For giving me back my PC
🙂
Found you from the message boards at Mozilla. They should put your fix up front! Worked great.
To thank you is simply not possible, it would be far to inadiquit. You are far better then probebly anyone, anyware… I hope you have a fantastic life!!!
THANK YOU, THANK YOU, THANK YOU, THANK YOU, THANK YOU!!!!!
Thank you so much! This popup has been driving me crazy for weeks now! The tool is genius.