NSIS Media Remover
I’ve assembled everything I’ve learned the past few weeks about NSIS Media into one simple and effortless application that should completely remove it. NSIS Media Remover removes installed files and registry keys.
93101 known DLL files installed into the system folder- C:\Program Files\Common Files\NSIS folder
- Firefox nsis.jar extension
- Many registry keys
- CLSIDs
- Shell extensions
- txtfile context menu handler
- Overlay icon handlers
- Software\NSIS\Media
- Software\IAN
- Add/Remove entry
NSIS Media Remover is provided without any warranty. Its source code is available in the tool itself. Hit the View Source Code button to get it.
md5: 7778c19e9df725d20a30fe42f425589d
sha1: 9eb42afbf75fd97555cc5260b3d24f33a6dec622
While creating this tool, I’ve found more exciting new facts about this pest. One of which is that apparently, CNET were fooled into serving the downloads on download.com. The installers check to see if the computer belongs to download sites, anti-virus companies and even Cydoor prior to installing the pest.
Update: version 1.1 was released on January 13th, 2007 with 8 more files missed in the original research.
December 16th, 2006 at 10:53
Wow so far this little app worked perfectly! Thanks a bunch!
December 17th, 2006 at 8:49
Thanks for this, it worked great! Going to direct people here.
December 18th, 2006 at 14:56
Thanks. Everything seems to be running smooth. Plus the background info you have dug up really helped.
December 20th, 2006 at 4:40
Found a link at the end of a discussion of this NSIS scourge. After reading I speculate that I got this NSIS nightmare from installing Turbo Torrent. Spybot search & destroy continually removed it, an it has just reinstalled everytime. The symptoms were that Firefox continually lagged, jumping when I tried to scroll, and tons of ping requests and port blocks blocked by my firewall. It was getting so bad I could hardly do anything without a block popping up. Those blasted ads as well. I manually deleted lots of files according to the forums, but to no avail. After running your NSIS media remover all is silent. Scrolling is smooth. I removed Turbo Torrent and I hope never to run into this problem again. What I do hope is to find who is behind this. It might be useful to block all websites related to these evil-doers by adding their IP’s to a blocklist either in peer guardian or in some other fashion. My Symantec antivirus found nothing, Adaware found nothing, Spybot could not adequately cope with it and I pulled out all my hair except 1.
Thank you is hardly adequate, but all I have before my children and ex-wife emptied my bank account this Xmas. You are extraordinarily intelligent to have figured this out. Thank you thank you thank you!
December 20th, 2006 at 16:34
Hello,
It’s about some time that someone made a NSIS Media Remover. I bet you’ve heard that I made the following site: http://www.freewebs.com/picaflic and that I am one of the first people to find a way to remove the NSIS Media Worm be downloading TrojanHunter. Well, I did put your site on my page. I hope this tool helps everyone!
December 20th, 2006 at 19:10
Just ran your anti-NSIS Media prog. So far, so good!
Was about to go in search of a commercial prog. to try and get rid of this evil crap. Your solution seems to be working. Thank You, Thank You, Thank You!!!!
December 22nd, 2006 at 11:37
An evil piece of work, I think I got with turbo torrent as well,
For the first time in weeks I,ll sleep soundly
thank you
December 23rd, 2006 at 15:04
Thank you much! I think mine came from turbo turrent , too. Keep up the great work!
December 24th, 2006 at 16:00
This killed NSIS completely! I am very grateful for your hard work and patience killing this nuiscence!
December 24th, 2006 at 18:20
Oh… Thank you so much for your time for creating this so useful tool!
I’ve been trying to get rid of NSIS with Spybot & with Spyware Terminator but nada!
Thank you have a merry Xmas and Happy New Year!
December 26th, 2006 at 3:45
I just wanted to say a big thankyou for this programme! I have spent the last hour or so scanning the web looking for instructions on how to remove this … and then I found your website and I am soooo grateful! Computer even seems to be faster now!
Your time and effort is so appreciated!
Once again, many thanks and Merry Christmas!
Jayne
December 26th, 2006 at 18:51
Used the remover and it seemed to work.
Thanks greatly for all the effort you put into it.
December 28th, 2006 at 15:57
Thank you thank you thank you!
Can’t believe Symantec have had at least 5-6 months to figure out how to remove NSIS and still antivirus doesn’t even pick up on its presence!
January 3rd, 2007 at 1:41
Thank you ! I got NSIS Media when installing Startup Mechanics and lost two hours trying removing it, before I found your program. It worked perfectly !
January 3rd, 2007 at 22:25
You are a godsend,thanks a lot kichik
January 4th, 2007 at 17:39
WOW….that was my first reaction,,,i have looked everywhere to get rid of this horrible nsis trojan and in my search came across your remover,,,hey thankyou soooo much,your a genius,,,please for everyones sake enter your remover in sites like http://www.downloads.com etc thankyou so much and keep up the good work
January 9th, 2007 at 9:05
Thanks a lot for this highly useful tiny cleanup utility. I tried manual removal, Spybot and McAfee Spyware removal program none of them we able to remove this complete. Your program did succeed though. I removed Turbo Torrent and I will never install this or any other program from download.com
Thank you very much one again.
January 10th, 2007 at 12:21
It DOESN’T WORK with me
It remove that folder an its compoments but the samepop up reappear again and again
+++PLEASE HELP+++
January 10th, 2007 at 22:09
wow, thanx so much. I was looking soo long for you to give me the solution. keep doing nice work
January 11th, 2007 at 19:50
DOM, please contact me by e-mail with more details. You can use the Contact page.
January 12th, 2007 at 17:37
Pls add the welcome.ini and other missing fils to the remover. cheers.
January 12th, 2007 at 18:04
Brummelchen, welcome.ini is already extracted to the source code folder and no other files are required. If UPX gives you problems, simply remove the !packhdr line.
January 13th, 2007 at 20:51
[...] I’ve updated my NSIS Media Remover to detect and remove those as well. I’ve also updated the samples archive, though it still doesn’t contain any of the old version DLL files. [...]
January 15th, 2007 at 3:50
it didnt work. the files are still there, but ill try it in safe mode now to see if that helps, this is SUCH apest. btw, whats the “source doe” for?
January 18th, 2007 at 17:42
Weston Clark, did you reboot? Which files? The source code is there so you can see what it does.
January 19th, 2007 at 0:25
I still did not know where this stuff comes from!
I did not install ANYTHING the last 3 days! The only thing i found out that only your tool was able to remove it completely! Spybot S&D missed a dll!
Thanks for that! You are my monthly hero
PS: A Question to you! My English is not very good, so i did not understand everything what your were writing about that stuff! What has CCCleaner to do with that? You mentioned it somewhere on your side!
January 19th, 2007 at 0:32
Ah yes,
i forgot to mention that i found throughout my registry searches that there was a short time a nsis.jar on my pc! So it seems that somehow Firefox was not able to block some script! Althoug im using the no-script addon from Firefox i allowed Java, because im writing sometimes small java-applets.
Thanks again!
January 19th, 2007 at 13:01
Liv, I mentioned CCleaner as an application that got ripped off by Foxie. CCleaner doesn’t contain NSIS Media, it was just another victim of it.
January 19th, 2007 at 15:07
can’t thank you enough for the remover. i hope those responsible rot in hell!
January 21st, 2007 at 23:45
Thankyou very much for this little utility. I only became infested with this nasty NSISMedia thing today and at first i thought it was a glitch but then it got worse as the day wore on. I found this utility from the CCleaner forums. Funny how my £50 Norton 2006 didn’t detect this and get rid of it, but your utility did it for free. You sir, are my hero of the hour. *tips hat.
Thankyou!
January 22nd, 2007 at 3:59
Thank you so much. So far, your program has worked like a charm!
January 23rd, 2007 at 21:38
A thousand thanks for this! Installed and it worked first time. No more nasty unwanted pop-up adverts. Thank you so much for giving me a happy peaceful PC!
Dan
January 26th, 2007 at 14:11
Was a bit skeptical at first to run this remover program but was desperate to get rid of the annoying ad pop-up. Worked the first time. Thanks, my PC is back to normal.
January 26th, 2007 at 23:28
Thank-you so much, tried 10 other “recommendations” before using this, one click and it was gone. Thanks!!!!
January 27th, 2007 at 1:28
Dude! Thank you! worked like a charm. chewed that NSIS jerk up and spit him out! very niiiiyce.
January 31st, 2007 at 19:42
Seems to be working so far… You’re awesome for making this.
February 8th, 2007 at 21:58
didn’t work…have tried this a bunch of times…still getting the popups…i think it is starting to mess up my programs…
February 9th, 2007 at 9:36
Josh, did you reboot after running the remover? If so, contact me using the Contact page with more details, including the output of the remover.
February 9th, 2007 at 14:04
Thanks alot!
I have updated zonalaram spyware and bitdefender byt neither of them could find them!
What a spyware it is !!!
I wish you best and wish someone pay you for that!
thanx again
February 13th, 2007 at 23:57
Best tool ever. xoxo
February 14th, 2007 at 11:39
Awesome! Thanks a lot!!
February 16th, 2007 at 16:07
Thanks man…you got skills…
February 18th, 2007 at 14:45
Wow…I’ve been trying to get rid of this forever. Just rebooted and it’s not showing in add/remove programs (hope it stays off). Thanks!
Thanks also to Paul (PicAFlic)…your comments in the Mozilla forum and your website were great help!
John
February 22nd, 2007 at 23:57
Dear Kichik,
My PC has been infected by NSIS Media for the past several month and I have done a lot of things to remove NSIS Media. Last thing I did was moving from Firefox to Opera, because it looks like Opera is the only browser that able to block NSIS Media…..
Last night, I have to use my Firefox again to view a web site that is not viewed right with Opera. And NSIS pop up again ! I try to search the web again for a new fix of NSIS, and I found your page. I read, study, download, and do virus scan. Then I run your “NSIS Media Remover”. It found some files, deleted some instantly, and mark some files for deletion after reboot.
Then I reboot.
After reboot I tried to run NSIS Media Remover for the second time, and NSIS was not found. Then I tried to run Firefox for sometime, no NSIS POPUP !! and then I leave Firefox running while I sleep. The next morning I checked my screen, also no sign of the NSIS popup !!!
Wow - this freeware is genius !!! Terima kasih banyak !!! (it’s Indonesian language, meaning : Thank you very much !!!)
Warm regards,
Hartono
February 24th, 2007 at 19:12
Thanks! Reading your blogs has made me feel a little better about infecting myself with the nsis malware. I am generally quite cautious; run regular ad aware scans, virus check all executables before launching and try my best to stick to “trusted” sources for software.
I had manually removed nsis from the registry and mozilla while adaware found its stub in \windows\system32. I used your scan and it happily found the residual bits & pieces. I’ve suggested my friends run your scan just to make sure they’re safe too.
February 25th, 2007 at 12:16
Your small but highly gifted tool blame the ignorant and incapable maker of antivirus and antispyware programs like Lavasoft and F-Secure Corporation. They got a lot of money from me but their programs don´t work well. Questions they don´t answer or they tell nonsense…
Thank you very much for your work.
Best regards from the Rhine river
Manfred
March 14th, 2007 at 19:51
Thank-you
Thank-you
Thank-you
For giving me back my PC
April 15th, 2007 at 19:03
Found you from the message boards at Mozilla. They should put your fix up front! Worked great.
April 16th, 2007 at 10:05
To thank you is simply not possible, it would be far to inadiquit. You are far better then probebly anyone, anyware… I hope you have a fantastic life!!!
THANK YOU, THANK YOU, THANK YOU, THANK YOU, THANK YOU!!!!!
April 27th, 2007 at 13:33
Thank you so much! This popup has been driving me crazy for weeks now! The tool is genius.
May 10th, 2007 at 10:33
Very well done, it works, simple and easy, gold star !
June 20th, 2007 at 13:42
I love you! you’re great!
June 28th, 2007 at 1:55
oh my LORD - I COULD KISS YOU!!!
This has been driving me MAD… hunting, searching, trying this that and the other thing… worried that this nasty thing was going to be the end of my circa 2000, Windows ME computer…
NOW, I can hobble on a little longer
by the way, WHAT EXACTLY does this nasty worm actually accomplish/do, other than p’sing me off??
kichik, if you know, please email me
you are a computer god and my newest hero
June 29th, 2007 at 3:48
[...] a combination of manual and automatic techniques. The last traces seem to be gone now, thanks to NSIS Media Remover and several uninstalls and re-installs of Firefox to deal with an infected “chrome” [...]
July 14th, 2007 at 17:55
Hey thanks! Worked like a charm, thank you =)
September 29th, 2007 at 14:01
Great job!
October 16th, 2007 at 19:34
just wanted to say thanks , this crap has been bugging me for the last week , not sure where i got it but hoping your tool will sort it out , thanks again
November 16th, 2007 at 19:25
Thanks so much. I have been fighting with NSIS for months now. It was a pleasure to find your remover program.
November 27th, 2007 at 9:33
just wanted to say thanks , installed your tool got rid of it straight away , dont know where i got that crap but thanks to you its gone
January 11th, 2008 at 11:18
It work perfectly. Thanks a lot!
February 13th, 2008 at 10:57
Thank you so very much !
April 11th, 2008 at 8:53
grazie
April 12th, 2008 at 21:22
I know that I am late with this however thank you very much for helping me get rid of the NSIS pest. I t was drivng me crazy until I came upon you remover program. I still run it from time to time just to make sure. Also I stopped downloading anything from download.com
July 29th, 2008 at 14:58
Thanks for the removal tool. Seems to have worked great. Pop-ups have stopped. Just FYI to all, I got infected by installing the Foxie browser extension for Internet Explorer.
August 7th, 2008 at 7:47
Thanks a lot your removal tool worked!
One question though, will it work with vista business premium? I’m sceptic to use it without checking it with you. Thanks again in advance.
August 7th, 2008 at 14:43
Never tested it on Vista, but there’s no reason it shouldn’t work. And if it doesn’t no harm done, you just get to keep the gem we have all come to know and love.