PUP.NSSMA is a potentially unwanted program (PUP) that typically arrives bundled with free software downloads and modifies browser settings without meaningful user consent. While not as destructive as ransomware or data-stealing trojans, this PUP disrupts your browsing experience through unwanted redirects, intrusive advertisements, and browser performance degradation. Its presence indicates that your system's security posture has been compromised, and other unwanted software may have been installed alongside it.
Users commonly encounter PUP.NSSMA after installing media converters, PDF creators, or download managers from third-party software repositories. The program operates in a legal gray area—technically not malware in the traditional sense, but absolutely unwanted by anyone who understands what it does. If you're seeing unexpected search redirects, toolbar changes you didn't authorize, or a sudden increase in pop-up advertisements, PUP.NSSMA or similar bundled software may be the culprit.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Potentially Unwanted Program (PUP) / Adware |
| Aliases | Adware.NSSMA, BrowserModifier:Win32/NSSMA, PUP.Optional.NSSMA |
| Platform | Windows (all versions); occasionally bundled with cross-platform installers |
| Discovered | Mid-2010s; variants continue to circulate through software bundling networks |
| Distribution | Software bundling (freeware installers), deceptive download buttons, fake update prompts |
| Persistence | Browser extensions, scheduled tasks, registry Run keys, Windows services (varies by variant) |
| Primary Capabilities | Browser hijacking, search redirection, advertising injection, user tracking, homepage/new-tab modification |
| Data Collection | Browsing history, search queries, clicked links, system information; typically used for ad targeting |
| Network Behavior | Contacts advertising networks and affiliate tracking domains; may download additional components |
| System Impact | Moderate—browser slowdown, increased CPU usage during browsing, potential privacy exposure |
| Removal Difficulty | Moderate; often requires manual browser cleanup + registry/task removal beyond basic uninstall |
| Financial Risk | Low direct risk; indirect risk through affiliate scams, fake tech support ads, or secondary PUP installations |
How It Spreads
PUP.NSSMA rarely travels alone. It's distributed through software bundling operations where legitimate-looking free programs carry hidden passengers in their installation packages. The installer presents a series of screens with pre-checked boxes or "Recommended Installation" options that include browser toolbars, search helpers, and system optimizers you never asked for. Many users click through these screens quickly, inadvertently agreeing to install multiple unwanted programs simultaneously.
The deception goes deeper than simple checkbox trickery. Distribution sites often feature multiple "Download" buttons on a single page, with the legitimate download link hidden among advertisements designed to look like download buttons. Clicking the wrong button starts a bundled installer download instead of the software you wanted. Fake update prompts—especially for Flash Player, Java, or media codecs—represent another common vector, with the "update" actually delivering PUP.NSSMA and related adware.
Common distribution methods include:
- Freeware bundle installers from third-party download sites (not official vendor sites)
- Deceptive advertising on file-sharing, streaming, or torrent sites featuring fake download buttons
- Fake software updates claiming your Flash Player, video codec, or browser needs updating
- Email attachments disguised as invoices or documents that launch installers instead of opening files
- Pirated software packages where cracks and keygens are bundled with PUPs and actual malware
- Malvertising campaigns on legitimate websites that redirect to exploit kit landing pages
- Search engine poisoning where results for popular software lead to bundler sites instead of official sources
What It Does On Your Machine
Once installed, PUP.NSSMA embeds itself into your web browsers and establishes persistence mechanisms that survive browser restarts and even basic uninstall attempts. The program modifies browser shortcuts to launch with altered homepage and search engine settings, ensuring that every new tab or window starts on an advertising-supported search page. These modified search engines generate revenue for the PUP's distributors through affiliate commissions on every search performed and every advertisement clicked.
Beyond simple browser hijacking, PUP.NSSMA typically injects additional advertisements into legitimate web pages you visit. You'll see extra banners, in-text link advertisements (where random words become clickable ad links), pop-under windows that appear when you close your browser, and interstitial ads that force you to wait before accessing content. This advertising injection works by monitoring your browsing activity and communicating with remote advertising servers that deliver targeted ads based on your behavior—creating both a performance problem and a privacy concern.
The program establishes persistence through multiple mechanisms, making it resilient to casual removal attempts. Browser extensions appear with innocuous names like "Search Helper" or "Web Companion." Scheduled tasks reinstall components if you delete them manually. Registry entries ensure the program launches at Windows startup. Some variants install Windows services that run continuously in the background, monitoring for removal attempts and re-enabling components you've disabled.
Performance degradation accompanies the privacy invasion. Your browser becomes noticeably slower as it loads injected advertisements, communicates with tracking servers, and runs the PUP's monitoring code. Startup times increase as persistence mechanisms activate during Windows boot. CPU usage spikes during browsing sessions as the program processes each page you visit to identify advertisement injection opportunities. Battery life suffers on laptops as these background processes consume power continuously.
Manual Removal — Step by Step
Disconnect and Document
Disconnect from the internet to prevent the PUP from downloading additional components or reporting your removal attempts to command servers. Take screenshots of any unusual toolbars, homepage changes, or pop-up messages so you can verify they're gone after cleanup. Write down what symptoms you're experiencing so you know what to check later.
Reboot to Safe Mode with Networking
Restart Windows in Safe Mode with Networking to prevent most PUP components from loading automatically. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart and select option 5 (Safe Mode with Networking). This mode loads only essential system files, making the PUP easier to remove.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11) and sort by installation date. Uninstall any programs you don't recognize that were installed around the time your problems started. Look for names containing "Search," "Web," "Helper," "Manager," or the actual "NSSMA" name. Uninstall anything suspicious even if you're not certain—legitimate programs are easy to reinstall later.
Kill Persistent Processes
Open Task Manager (Ctrl+Shift+Esc), click More Details, and look under the Processes tab for unfamiliar processes running from AppData folders. Right-click suspicious processes, select Open File Location, note the folder path, then End Task. If processes restart immediately, skip this step for now—your security software will handle them after detecting the files.
Remove Persistence Mechanisms
Press Win+R, type "taskschd.msc" and press Enter to open Task Scheduler. Review the Task Scheduler Library for tasks with suspicious names or descriptions. Delete any tasks that reference unfamiliar programs in AppData folders. Then press Win+R again, type "regedit," navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and delete entries pointing to AppData folders you don't recognize.
Delete PUP Files and Folders
Navigate to the folders you identified earlier (typically in C:\Users\[YourName]\AppData\Local\ or AppData\Roaming\). Delete entire folders related to NSSMA or other suspicious program names. If Windows says files are in use, restart in Safe Mode again and try deletion immediately after booting. Empty your Recycle Bin when finished to ensure files are truly removed.
Clean Your Browsers Thoroughly
For each browser you use, remove suspicious extensions (Chrome: three-dot menu > Extensions; Firefox: three-bar menu > Add-ons; Edge: three-dot menu > Extensions). Then reset browser settings to defaults: Chrome and Edge have a "Restore settings to their original defaults" option in Settings > Reset. Firefox has "Refresh Firefox" under Help > More Troubleshooting Information. This removes hijacked homepages and search engines but preserves bookmarks and passwords.
Scan with Reputable Anti-Malware Software
Download and run Malwarebytes Free (from malwarebytes.com) to catch any remnants you missed manually. Let it complete a full Threat Scan, which typically takes 20-40 minutes. Quarantine everything it finds. Consider running a second scan with a different scanner (like HitmanPro or AdwCleaner) since different tools detect different threats. Don't rely on Windows Defender alone for PUP removal—it's often too permissive with borderline programs.
Change Passwords from a Clean Device
If PUP.NSSMA was present for more than a few days, assume it captured some browsing data including potentially sensitive information. Before using your computer for banking or email, change important passwords from a different device (phone, tablet, or another computer). Focus on email, banking, and any accounts with stored payment information first.
Reboot and Verify Normal Operation
Restart Windows normally (not in Safe Mode) and verify that your symptoms are gone. Check that your browser homepage and search engine are what you expect, that no unexpected toolbars appear, and that websites load without injected advertisements. Monitor CPU usage in Task Manager during the first few browsing sessions to confirm no background processes are still running. If problems persist, you may have additional infections requiring professional assistance.
Prevention
- Download software only from official vendor websites. Avoid third-party download sites like Softonic, Download.com, or CNET Download entirely. Google the software name plus "official site" and verify the URL before downloading. Software vendors offer direct downloads for free—there's never a legitimate reason to use an aggregator site.
- Choose Custom/Advanced installation and read every screen. Never click "Express Installation" or "Recommended Settings" when installing free software. Select Custom or Advanced, then carefully uncheck any pre-selected offers for toolbars, browser helpers, search managers, or system optimizers. If an installer makes it difficult to decline offers (tiny checkboxes, confusing language, hidden "Decline" buttons), cancel the installation entirely—the software isn't trustworthy.
- Keep Windows and all software updated through official channels. Enable automatic updates for Windows, and configure your applications to auto-update when possible. If you see a popup claiming you need to update Flash Player, Java, or any other software, close the popup and go directly to the vendor's website to check for updates manually. Flash Player is discontinued anyway—no legitimate site requires it anymore.
- Use browser security extensions that block known malicious sites. Install uBlock Origin (not just "uBlock") in your browser to block advertisements that might redirect to bundler sites. Consider adding a reputable anti-malware browser extension like Malwarebytes Browser Guard. These tools block access to known distribution sites before you can accidentally download anything.
- Maintain regular backups of your important files. Weekly backups to an external drive or cloud service ensure you can recover if you need to perform a clean Windows reinstall. PUPs rarely destroy files, but the nuclear option of wiping and reinstalling Windows becomes much more attractive when you know your data is safe. Disconnect backup drives when not actively backing up to prevent infections from spreading to them.
- Run periodic security scans even when nothing seems wrong. Schedule monthly full-system scans with Malwarebytes or similar software. Many PUPs operate silently in the background for weeks before you notice symptoms. Regular scans catch infections in their early stages when they're easier to remove completely.
- Educate everyone who uses your computer about these risks. Kids, spouses, elderly parents, and employees all need to understand that "free" software often isn't free—it comes with unwanted passengers. Make sure everyone knows to call you or ask questions before installing anything they found through a web search. Most PUP infections happen because someone other than the computer's owner clicked through a deceptive installer.
- Consider using a limited user account for daily activities. Windows runs with administrator privileges by default, which allows PUPs to install system-wide components easily. Creating a standard user account for daily browsing and work makes it harder for unwanted software to establish deep persistence. Reserve the administrator account for intentional software installation only.
Bring It In
Manual removal works for many PUP.NSSMA infections, but some variants dig deeper than others or arrive bundled with actual trojans and rootkits that require professional tools to detect and remove. If you've followed the steps above and still experience browser redirects, unexpected advertisements, or suspicious background processes, the infection may be more complex than a straightforward PUP. We see this regularly—what looks like simple adware turns out to be the visible symptom of a more serious compromise.
Computer Repair Roswell specializes in thorough malware removal for customers in Roswell and surrounding north Atlanta communities. We use professional-grade diagnostic tools that go beyond consumer antivirus software, checking not just for known malware signatures but for suspicious behavior patterns that indicate zero-day threats or custom variants. Our technicians will completely clean your system, verify that no data theft occurred, help you secure your accounts if necessary, and explain what happened so you can avoid reinfection. Call us at (770) 691-6890 or stop by our shop at 1235 Alpharetta Street during business hours. We'll diagnose the problem while you wait and give you an honest assessment of what's needed to get your computer back to normal.