Hello,

I am using Vista and NIS 2010.

Last night whilst the computer was doing nothing but a full system scan, an install pop up came up with the usual allow/disallow options. I disallowed it, and shut down the pc for the night. However it popped up again when I turned the PC back on, I left it on the screen for a few minutes and when I got back it was gone. I tried rebooting several times and it never popped up again leaving me wondering what was going on.

Tonight I rebooted again, and it popped up once again on start up and I was able to write it down and disallow it again.

No publisher info appeared in the box.

Here is what it claims to be:

c:\windows\Microsoft .Net\Framework\v1.1.4322\netfxupdate.exe 1 v1.1.4322 GAC + NI NID

There is an application called netfxupdate in that folder, however it does not have the 1 v1.1.4322 bla bla after it.

According to properties-details, it was last modified (and created) on: 10 ‎August ‎2004, ‏‎16:20:00   but it was accessed: ‎09 ‎June ‎2010, ‏‎09:53:23

Googling it brought up the usual selection of 'its essential windows software, let it run' , to 'it might be a trojan/rootkit' to 'it WILL destroy your PC' options which aren't terribly helpful. Norton full system scan just brings up the usual tracking cookies, so I'm at a loss as to what to do, I've never heard of this file before now and have no idea why it is suddenly trying to run somehow.

My only possible idea is I installed Medieval Total War 2 on the 7th, which I believe the last patch for also installs .Net Framework 1.1. However .Net Framework 1.1 is listed as installed on the 9th on the programs list of control panel, and if it was due to that, why has it taken until now to start doing something?

Any help would be appreciated in determining if this is a threat, a normal process, and what to do about it.