Spyware Questions and Answers - A~NSISu_.exe File Appears on Computer
Junior writes in with a spyware question
Question: A strange, executable filename has popped up in my MICROSOFT® WINDOWS®XP system, A~NSISu_.exe. Note the second char. is a tilde (~) not a hyphen. I have just installed Adobe Reader 8.0 and updated that from Adobe's update site with what it called, "Language extensions" or something like that, 16 MB worth. This strange file is found in my primary personal profile, an Admin profile, in C:\\Documents and settings\<my profile>\Local Settings\Temp. I was in this profile for the purpose of doing a System Restore (apparently successful) and installing the Adobe Reader 8. This filename is not found in the "Search for Help”. Anybody know if A~NSISu .exe is a threat, malware, or legit?
Answer: It appears that the A~NSISu_.exe file may be spyware related. I would do a few things to clean your system. First I would download and install CCleaner. It is a nice free utility that cleans out temporary and unneeded files from your system. Just be aware that it will empty your recycle bin and delete your cookies unless you uncheck those boxes telling it not to.
I would also download and install a couple of free anti spyware utilities. We have found that Spybot and AdAware work great. Just make sure to update them after you install them. After you install and update them I would start your computer in Safe Mode and run your scans from there.
Another step you may want to take before booting into Safe Mode is to check your startup items using msconfig and look for any entries relating to the A~NSISu_.exe file. If its still running when you try to remove it then there is a good chance you or the anti spyware software won't be able to delete it. You can also uncheck any other suspicious looking items or other things you don't need to have running when you start your computer.
When you get into Safe Mode open up Task Manager and see if the A~NSISu_.exe file is running under the Processes tab and stop the process before running the scans.