Another question about NUA.exe

I use Vista 32 bit home premium with the Vista service package 2 and NAV2008 ( Will upgrade to NIS2010 as soon as I get the money)

In an effort to learn more about computers, I have taken to checking things periodically. No longer  to find "monsters under the bed", but to learn a little more about computers

I know that NUA.exe is Norton Update Agent and is a file from symantec. And it has to do with notifying us users of older products about UPGRADES

 I currently show it in

C:\ProgramData\Norton\NUA.exe

But yesterday I noticed when my scheduled live update ran, I also noticed NUA.exe had run at or near the same time.

No problem, would make some sense

However, it appeared that that it ran out of

C:\ProgramData\Symantec\Liveupdate\Downloads\Liveupdate

when I went to that location, there was a liveupdate folder, but it showed empty.

Today when I go to C:\ProgramData\Symantec\Liveupdate\Downloads\    I do not see a LiveUpdate folder

(I still show it in C:\ProgramData\Norton\NUA.exe)

 1. Could it have been a malicious file that showed itself as NUA.exe and placed itself somewhere in C:\ProgramData\Symantec ?

 

2. would it make sense that  it would show in C:\ProgramData\Symantec\Liveupdate\Downloads\ when it ran, but then remove itself later from that location?

I have no problem getting my updates and scans with NAV, Malwarebytes(on demand), and SpyBOT(on demand) all show clean so I am not infected

If anyone can explain the sequence of events I outlined, I'd be much appreciative.