kichik’s blog

NSIS Media Remover

I’ve assembled everything I’ve learned the past few weeks about NSIS Media into one simple and effortless application that should completely remove it. NSIS Media Remover removes installed files and registry keys.

93 101 known DLL files installed into the system folder
C:\Program Files\Common Files\NSIS folder
Firefox nsis.jar extension
Many registry keys
- CLSIDs
- Shell extensions
- txtfile context menu handler
- Overlay icon handlers
- Software\NSIS\Media
- Software\IAN
- Add/Remove entry

NSIS Media Remover is provided without any warranty. Its source code is available in the tool itself. Hit the View Source Code button to get it.

Download NSIS Media Remover

md5: 7778c19e9df725d20a30fe42f425589d
sha1: 9eb42afbf75fd97555cc5260b3d24f33a6dec622

While creating this tool, I’ve found more exciting new facts about this pest. One of which is that apparently, CNET were fooled into serving the downloads on download.com. The installers check to see if the computer belongs to download sites, anti-virus companies and even Cydoor prior to installing the pest.

Update: version 1.1 was released on January 13th, 2007 with 8 more files missed in the original research.

This entry was posted on Friday, December 15th, 2006 at 17:01 and is filed under NSIS. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

71 Responses to “NSIS Media Remover”

December 16th, 2006 at 10:53
Crash Says:

Wow so far this little app worked perfectly! Thanks a bunch!
December 17th, 2006 at 8:49
Kyle Says:

Thanks for this, it worked great! Going to direct people here.
December 18th, 2006 at 14:56
PJ Says:

Thanks. Everything seems to be running smooth. Plus the background info you have dug up really helped.
December 20th, 2006 at 4:40
Gordon Says:

Found a link at the end of a discussion of this NSIS scourge. After reading I speculate that I got this NSIS nightmare from installing Turbo Torrent. Spybot search & destroy continually removed it, an it has just reinstalled everytime. The symptoms were that Firefox continually lagged, jumping when I tried to scroll, and tons of ping requests and port blocks blocked by my firewall. It was getting so bad I could hardly do anything without a block popping up. Those blasted ads as well. I manually deleted lots of files according to the forums, but to no avail. After running your NSIS media remover all is silent. Scrolling is smooth. I removed Turbo Torrent and I hope never to run into this problem again. What I do hope is to find who is behind this. It might be useful to block all websites related to these evil-doers by adding their IP’s to a blocklist either in peer guardian or in some other fashion. My Symantec antivirus found nothing, Adaware found nothing, Spybot could not adequately cope with it and I pulled out all my hair except 1.
Thank you is hardly adequate, but all I have before my children and ex-wife emptied my bank account this Xmas. You are extraordinarily intelligent to have figured this out. Thank you thank you thank you!
December 20th, 2006 at 16:34
Paul (PicAFlic) Says:

Hello,
It’s about some time that someone made a NSIS Media Remover. I bet you’ve heard that I made the following site: http://www.freewebs.com/picaflic and that I am one of the first people to find a way to remove the NSIS Media Worm be downloading TrojanHunter. Well, I did put your site on my page. I hope this tool helps everyone!
December 20th, 2006 at 19:10
John Rogers Says:

Just ran your anti-NSIS Media prog. So far, so good!
Was about to go in search of a commercial prog. to try and get rid of this evil crap. Your solution seems to be working. Thank You, Thank You, Thank You!!!!
December 22nd, 2006 at 11:37
taya Says:

An evil piece of work, I think I got with turbo torrent as well,
For the first time in weeks I,ll sleep soundly
thank you
December 23rd, 2006 at 15:04
Tim Says:

Thank you much! I think mine came from turbo turrent , too. Keep up the great work!
December 24th, 2006 at 16:00
Dave Says:

This killed NSIS completely! I am very grateful for your hard work and patience killing this nuiscence!
December 24th, 2006 at 18:20
Eldar Says:

Oh… Thank you so much for your time for creating this so useful tool!

I’ve been trying to get rid of NSIS with Spybot & with Spyware Terminator but nada!

Thank you have a merry Xmas and Happy New Year!
December 26th, 2006 at 3:45
Jayne Says:

I just wanted to say a big thankyou for this programme! I have spent the last hour or so scanning the web looking for instructions on how to remove this … and then I found your website and I am soooo grateful! Computer even seems to be faster now!

Your time and effort is so appreciated!

Once again, many thanks and Merry Christmas!

Jayne
December 26th, 2006 at 18:51
Mike Says:

Used the remover and it seemed to work.

Thanks greatly for all the effort you put into it.
December 28th, 2006 at 15:57
Rhys Says:

Thank you thank you thank you!

Can’t believe Symantec have had at least 5-6 months to figure out how to remove NSIS and still antivirus doesn’t even pick up on its presence!
January 3rd, 2007 at 1:41
Fabien Says:

Thank you ! I got NSIS Media when installing Startup Mechanics and lost two hours trying removing it, before I found your program. It worked perfectly !
January 3rd, 2007 at 22:25
minibomb74 Says:

You are a godsend,thanks a lot kichik
January 4th, 2007 at 17:39
mark,,,from england Says:

WOW….that was my first reaction,,,i have looked everywhere to get rid of this horrible nsis trojan and in my search came across your remover,,,hey thankyou soooo much,your a genius,,,please for everyones sake enter your remover in sites like http://www.downloads.com etc thankyou so much and keep up the good work
January 9th, 2007 at 9:05
Lakshman Says:

Thanks a lot for this highly useful tiny cleanup utility. I tried manual removal, Spybot and McAfee Spyware removal program none of them we able to remove this complete. Your program did succeed though. I removed Turbo Torrent and I will never install this or any other program from download.com

Thank you very much one again.
January 10th, 2007 at 12:21
DOM Says:

It DOESN’T WORK with me
It remove that folder an its compoments but the samepop up reappear again and again

+++PLEASE HELP+++
January 10th, 2007 at 22:09
syco Says:

wow, thanx so much. I was looking soo long for you to give me the solution. keep doing nice work
January 11th, 2007 at 19:50
kichik Says:

DOM, please contact me by e-mail with more details. You can use the Contact page.
January 12th, 2007 at 17:37
Brummelchen Says:

Pls add the welcome.ini and other missing fils to the remover. cheers.
January 12th, 2007 at 18:04
kichik Says:

Brummelchen, welcome.ini is already extracted to the source code folder and no other files are required. If UPX gives you problems, simply remove the !packhdr line.
January 13th, 2007 at 20:51
kichik.net » Blog Archive » Missed evil files Says:

[...] I’ve updated my NSIS Media Remover to detect and remove those as well. I’ve also updated the samples archive, though it still doesn’t contain any of the old version DLL files. [...]
January 15th, 2007 at 3:50
weston clark Says:

it didnt work. the files are still there, but ill try it in safe mode now to see if that helps, this is SUCH apest. btw, whats the “source doe” for?
January 18th, 2007 at 17:42
kichik Says:

Weston Clark, did you reboot? Which files? The source code is there so you can see what it does.
January 19th, 2007 at 0:25
Liv Says:

I still did not know where this stuff comes from!
I did not install ANYTHING the last 3 days! The only thing i found out that only your tool was able to remove it completely! Spybot S&D missed a dll!

Thanks for that! You are my monthly hero

PS: A Question to you! My English is not very good, so i did not understand everything what your were writing about that stuff! What has CCCleaner to do with that? You mentioned it somewhere on your side!
January 19th, 2007 at 0:32
Liv Says:

Ah yes,

i forgot to mention that i found throughout my registry searches that there was a short time a nsis.jar on my pc! So it seems that somehow Firefox was not able to block some script! Althoug im using the no-script addon from Firefox i allowed Java, because im writing sometimes small java-applets.

Thanks again!
January 19th, 2007 at 13:01
kichik Says:

Liv, I mentioned CCleaner as an application that got ripped off by Foxie. CCleaner doesn’t contain NSIS Media, it was just another victim of it.
January 19th, 2007 at 15:07
tomr Says:

can’t thank you enough for the remover. i hope those responsible rot in hell!
January 21st, 2007 at 23:45
Emma Says:

Thankyou very much for this little utility. I only became infested with this nasty NSISMedia thing today and at first i thought it was a glitch but then it got worse as the day wore on. I found this utility from the CCleaner forums. Funny how my £50 Norton 2006 didn’t detect this and get rid of it, but your utility did it for free. You sir, are my hero of the hour. *tips hat.

Thankyou!
January 22nd, 2007 at 3:59
David Says:

Thank you so much. So far, your program has worked like a charm!
January 23rd, 2007 at 21:38
Dan Says:

A thousand thanks for this! Installed and it worked first time. No more nasty unwanted pop-up adverts. Thank you so much for giving me a happy peaceful PC!
Dan
January 26th, 2007 at 14:11
LT Says:

Was a bit skeptical at first to run this remover program but was desperate to get rid of the annoying ad pop-up. Worked the first time. Thanks, my PC is back to normal.
January 26th, 2007 at 23:28
Anon Says:

Thank-you so much, tried 10 other “recommendations” before using this, one click and it was gone. Thanks!!!!
January 27th, 2007 at 1:28
Danny Darko Says:

Dude! Thank you! worked like a charm. chewed that NSIS jerk up and spit him out! very niiiiyce.
January 31st, 2007 at 19:42
Sam Says:

Seems to be working so far… You’re awesome for making this.
February 8th, 2007 at 21:58
Josh Says:

didn’t work…have tried this a bunch of times…still getting the popups…i think it is starting to mess up my programs…
February 9th, 2007 at 9:36
kichik Says:

Josh, did you reboot after running the remover? If so, contact me using the Contact page with more details, including the output of the remover.
February 9th, 2007 at 14:04
Mehdi Says:

Thanks alot!
I have updated zonalaram spyware and bitdefender byt neither of them could find them!

What a spyware it is !!!

I wish you best and wish someone pay you for that!
thanx again
February 13th, 2007 at 23:57
Tappy Tibbons Says:

Best tool ever. xoxo
February 14th, 2007 at 11:39
Neoalfa Says:

Awesome! Thanks a lot!!
February 16th, 2007 at 16:07
JP Says:

Thanks man…you got skills…
February 18th, 2007 at 14:45
John J. Says:

Wow…I’ve been trying to get rid of this forever. Just rebooted and it’s not showing in add/remove programs (hope it stays off). Thanks!
Thanks also to Paul (PicAFlic)…your comments in the Mozilla forum and your website were great help!
John
February 22nd, 2007 at 23:57
Hartono from Indonesia Says:

Dear Kichik,

My PC has been infected by NSIS Media for the past several month and I have done a lot of things to remove NSIS Media. Last thing I did was moving from Firefox to Opera, because it looks like Opera is the only browser that able to block NSIS Media…..

Last night, I have to use my Firefox again to view a web site that is not viewed right with Opera. And NSIS pop up again ! I try to search the web again for a new fix of NSIS, and I found your page. I read, study, download, and do virus scan. Then I run your “NSIS Media Remover”. It found some files, deleted some instantly, and mark some files for deletion after reboot.

Then I reboot.

After reboot I tried to run NSIS Media Remover for the second time, and NSIS was not found. Then I tried to run Firefox for sometime, no NSIS POPUP !! and then I leave Firefox running while I sleep. The next morning I checked my screen, also no sign of the NSIS popup !!!

Wow – this freeware is genius !!! Terima kasih banyak !!! (it’s Indonesian language, meaning : Thank you very much !!!)

Warm regards,
Hartono
February 24th, 2007 at 19:12
Chris Douglas Says:

Thanks! Reading your blogs has made me feel a little better about infecting myself with the nsis malware. I am generally quite cautious; run regular ad aware scans, virus check all executables before launching and try my best to stick to “trusted” sources for software.

I had manually removed nsis from the registry and mozilla while adaware found its stub in \windows\system32. I used your scan and it happily found the residual bits & pieces. I’ve suggested my friends run your scan just to make sure they’re safe too.
February 25th, 2007 at 12:16
Manfred Says:

Your small but highly gifted tool blame the ignorant and incapable maker of antivirus and antispyware programs like Lavasoft and F-Secure Corporation. They got a lot of money from me but their programs don´t work well. Questions they don´t answer or they tell nonsense…

Thank you very much for your work.
Best regards from the Rhine river

Manfred
March 14th, 2007 at 19:51
Dave the Wave Says:

Thank-you
Thank-you
Thank-you

For giving me back my PC
April 15th, 2007 at 19:03
Brian Steinbach Says:

Found you from the message boards at Mozilla. They should put your fix up front! Worked great.
April 16th, 2007 at 10:05
Johan Says:

To thank you is simply not possible, it would be far to inadiquit. You are far better then probebly anyone, anyware… I hope you have a fantastic life!!!

THANK YOU, THANK YOU, THANK YOU, THANK YOU, THANK YOU!!!!!
April 27th, 2007 at 13:33
Lucy Says:

Thank you so much! This popup has been driving me crazy for weeks now! The tool is genius.
May 10th, 2007 at 10:33
jcrackhorn Says:

Very well done, it works, simple and easy, gold star !
June 20th, 2007 at 13:42
NeedHelp Says:

I love you! you’re great!
June 28th, 2007 at 1:55
MaryBarrow Says:

oh my LORD – I COULD KISS YOU!!!

This has been driving me MAD… hunting, searching, trying this that and the other thing… worried that this nasty thing was going to be the end of my circa 2000, Windows ME computer…
NOW, I can hobble on a little longer

by the way, WHAT EXACTLY does this nasty worm actually accomplish/do, other than p’sing me off??
kichik, if you know, please email me

you are a computer god and my newest hero
June 29th, 2007 at 3:48
surflizard » Good Enough PC Goes To The Basement Says:

[...] a combination of manual and automatic techniques. The last traces seem to be gone now, thanks to NSIS Media Remover and several uninstalls and re-installs of Firefox to deal with an infected “chrome” [...]
July 14th, 2007 at 17:55
Donn Says:

Hey thanks! Worked like a charm, thank you =)
September 29th, 2007 at 14:01
Gig Says:

Great job!
October 16th, 2007 at 19:34
W130SN Says:

just wanted to say thanks , this crap has been bugging me for the last week , not sure where i got it but hoping your tool will sort it out , thanks again
November 16th, 2007 at 19:25
Robert Says:

Thanks so much. I have been fighting with NSIS for months now. It was a pleasure to find your remover program.
November 27th, 2007 at 9:33
ACE-KING Says:

just wanted to say thanks , installed your tool got rid of it straight away , dont know where i got that crap but thanks to you its gone
January 11th, 2008 at 11:18
Batata Says:

It work perfectly. Thanks a lot!
February 13th, 2008 at 10:57
Steen AA Says:

Thank you so very much !
April 11th, 2008 at 8:53
franco from rome Says:

grazie
April 12th, 2008 at 21:22
dangerlad Says:

I know that I am late with this however thank you very much for helping me get rid of the NSIS pest. I t was drivng me crazy until I came upon you remover program. I still run it from time to time just to make sure. Also I stopped downloading anything from download.com
July 29th, 2008 at 14:58
Gordon Says:

Thanks for the removal tool. Seems to have worked great. Pop-ups have stopped. Just FYI to all, I got infected by installing the Foxie browser extension for Internet Explorer.
August 7th, 2008 at 7:47
SIGHT Says:

Thanks a lot your removal tool worked!

One question though, will it work with vista business premium? I’m sceptic to use it without checking it with you. Thanks again in advance.
August 7th, 2008 at 14:43
kichik Says:

Never tested it on Vista, but there’s no reason it shouldn’t work. And if it doesn’t no harm done, you just get to keep the gem we have all come to know and love.
September 27th, 2008 at 6:41
NuGELO Says:

Thanks, for the effort..
those pop-up advertise really stress me out.
November 18th, 2008 at 23:25
Laser Lag Says:

Thank you so much for this.
January 20th, 2009 at 9:10
KingMatt Says:

This program still kicking around in 2009, killed the nasty little thing. Very much appreciated! Thank you Kichik man. woo woo
February 16th, 2009 at 6:52
TRIRATNA from indonesia Says:

THANK YOU! THANK YOU SO MUCH! you are the best,Kichik!
April 18th, 2009 at 13:23
NSIS FUCKING MEDIA Says:

NSIS MEDIA IT’S SHIT ALL

Pages

Archives

Categories

NSIS Media Remover

71 Responses to “NSIS Media Remover”

Leave a Reply