The original Windows binary doesn't need an installation, also no admin permissions. You just put the nsfminer.exe somewhere and run it (with arguments, so from a .bat file for more convenience). When running "nfsminer --help" on a CMD window it should output help infos, instead of asking for admin permissions and trying to install something.

For me the trojan created a file znsfminer.exe in C:\Windows\SysWOW64 - it also created the files helpane.exe and libssp-0.dll in C:\Users\username\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.1.3. That's the thing's I know because Windows Defender detected them. I don't know whether there is more and I should rather reinstall Windows now, still investigating...