06-13-2010 02:00 PM
I am using Vista and NIS 2010.
Last night whilst the computer was doing nothing but a full system scan, an install pop up came up with the usual allow/disallow options. I disallowed it, and shut down the pc for the night. However it popped up again when I turned the PC back on, I left it on the screen for a few minutes and when I got back it was gone. I tried rebooting several times and it never popped up again leaving me wondering what was going on.
Tonight I rebooted again, and it popped up once again on start up and I was able to write it down and disallow it again.
No publisher info appeared in the box.
Here is what it claims to be:
c:\windows\Microsoft .Net\Framework\v1.1.4322\netfxupdate.exe 1 v1.1.4322 GAC + NI NID
There is an application called netfxupdate in that folder, however it does not have the 1 v1.1.4322 bla bla after it.
According to properties-details, it was last modified (and created) on: 10 August 2004, 16:20:00 but it was accessed: 09 June 2010, 09:53:23
Googling it brought up the usual selection of 'its essential windows software, let it run' , to 'it might be a trojan/rootkit' to 'it WILL destroy your PC' options which aren't terribly helpful. Norton full system scan just brings up the usual tracking cookies, so I'm at a loss as to what to do, I've never heard of this file before now and have no idea why it is suddenly trying to run somehow.
My only possible idea is I installed Medieval Total War 2 on the 7th, which I believe the last patch for also installs .Net Framework 1.1. However .Net Framework 1.1 is listed as installed on the 9th on the programs list of control panel, and if it was due to that, why has it taken until now to start doing something?
Any help would be appreciated in determining if this is a threat, a normal process, and what to do about it.
06-13-2010 02:22 PM
Welcome to the Norton Users Discussion Forum
This week with the Windows Updates, there was a whole slew of updates. I'm pretty sure that some of them had to do with Net Frame and some updates for them, service packs etc. Please check your list of windows updates that should have been downloaded and installed this past week and see if any of them correspond to what you are seeing now in those popups.
Please come back and let us know what you found out. Thanks.
Success always occurs in private and failure in full view.
06-13-2010 02:37 PM
Thanks for the reply.
According to control panel security center, the last updates installed were on the 11th, including this:
Microsoft .NET Framework 1.1 SP1 Security Update for Windows Vista and Windows Server 2008 (KB979906)
According to the microsoft blurb that security update, from the 8th includes a number of files using the version number 1.1.4322.2463.
So it is possible that is it, however I would have thought if it were then it would have shown the publisher as Microsoft rather than Unknown, and that I would have seen it before last night. Rather odd although that does make it seem more likely it is legitimate.
06-13-2010 02:44 PM
Actually there was an update for .Net 1.1 (http://support.microsoft.com/?kbid=979906), but I'm not 100% sure, if this happens because of that....
Windows 7 Home Premium SP1 x64 Hungarian, Norton 360 v220.127.116.11, Norton Utilities 16