Nebraska's #1 Voted Computer Repair Company

Remove NSIS Media Malware and Trojan

This tutorial will explain what NSIS Media is, how you got infected with NSIS Media, and what you need to do IMMEDIATELY to remove NSIS Media from your PC and repair your FireFox browser.

This website is the largest collection of information on the web about the NSIS Media malware infection (and trojan) that is plaguing your FireFox installation. This remove NSIS Media tutorial is a multi-page tutorial, so be certain to follow the links below and follow all directions precisely.

Whle the precise origins of the NSIS Media infection (not to be confused with the legitimate NSIS Media Installer) is somewhat vague, many online discussions and software reviews appear to peg the infection’s source to a number of freeware and shareware programs authored by a company called Openwares that were made available ontheir website, www.openwares.org, as well as CNET’s Download.com.

The main culprit appears to be their Arcade Classic Arcade Pack 5 with more than 1.8 million downloads since June of 2006. Click here for a complete list of Openwares’ software available on Downlad.com. Openwares.org is also a software download website that houses software from multiple authors. There have been reports that downloading and installing the Foxie browser and firewall also result in becoming infected with the NSIS Media malware. There have also been reports (although not confirmed) that updating FireFox extensions can also result in infection.

Once you become infected with NSIS your firefox browser will use the explorer.exe file in your Windows installation to begin displaying pop-up advertisements when you are using your FireFox browser. To our knowledge, this is the first successful widespread attempt to infect the FireFox browser specifically with advertising malware. The trojan infection provides you with a removal lin in your add/remove programs control panel, however reports indicate that this is simply a ruse to make users believe the software has been removed. After the removal completes, users are instructed to restart their computer. Upon restarting the infecion is reinstalled and will continue to deliver advertising content.

Many anti-virus and anti-malware companies are beginning to list this infection as a malware trojan, however investigation into the infection as a whole is ongoing. what is aparent is that this infection specifically targets the FireFox browser and requires the complete removal of FireFox and the accompanying infection before the opensource browser can be reinstalled.

NOTE: We strongly suggest that you disable System Restore before continuing. Old scraps of the NSIS Media or software may be stored in your System Restore points. Use the links below to view a help article on disabling System Restore that is appropriate for your Operating System.

Disable System Restore in Windows XP

Remove NSIS Media Step 1 – First, you will need to boot your computer into Safe Mode. This will help ensure that the NSIS Media and/or infections are not running while you are attempting to remove NSIS Media. Select ‘Safe Mode With Networking Support” if you can not print this tutorial before you reboot. Before you reboot, you should click here to bookmark this page. (Ctrl+D) because you will need to restart your PC. This is a critical step, so don’t skip it!

Remove NSIS Media Step 2 – Once your computer has been rebooted into Safe Mode, you will need to manually delete some files from your computer. Navigate to and delete the files and folders listed below:

  • C:\Program Files\Common Files\NSIS
  • C:\Program Files\Mozilla Firefox\Chrome

Now empty your Recycle Bin.

Remove NSIS Media Step 3 – After you have emptied your Recycle Bin, you need to open your Control Panels ( Start –> Control Panels) and then double click on the Add/Remove Programs icon. When the Add/Remove Programs window finishes populating, you need to remove the following programs:

  • Mozilla Firefox
  • NSIS Media

Removing FireFox is necessary because deleting the Chrome folder from your FireFox installation will effectively break your FireFox installation. Before reinstalling FireFox it is recommended that you completely uninstall it. Whne you attempt to uninstall NSIS Media, your computer should inform you that the program is not on your computer and should ask you if you would like the entry removed from your Add/Remove Programs list. Click Yes.

Remove NSIS Media Step 4 – With the removal out of th way, reboot your computer into regular mode by clicking on Start, then Shut Down, then Restart. Once your system has rebooted you need to download and reinstall the FireFox browser from a TRUSTED source. For the purposes of this tutorial, we have included a link on the right to download FireFox from Google’s servers for obvious reasons.

Once you have reinstalled FireFox, you should be free of the NSIS infection. Keep in mind that this infection may have entered your computer through the installation of a free piece of sftware from Download.com or it could have been hidden in an extension update. Be extremely careful not to reinfect yourself. Many people have reported that their removal attempts have not been successful, however the actual cause of reinfection is often user error.

Share this post