AdvinstAnalytics folder: what it is, is it a virus, and how to remove it
AdvinstAnalytics is a folder in %LocalAppData% that setup files built with Advanced Installer's analytics option leave behind, with a small tracking.ini text file in it. It is not a virus and no report ties it to ads or redirects, so you can delete it or leave it, and it returns the next time such a setup runs.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If you are not sure which AdvinstAnalytics is genuine, a free scan of the PC compares them for you.
Do it yourself · free Remove AdvinstAnalytics yourself 4 steps, about 12 minutes, no software needed.
Start the steps
AdvinstAnalytics: summary
| Type | A data folder (%LocalAppData%\AdvinstAnalytics) left by installers built with Advanced Installer's Installer Analytics; not adware in any source we read |
|---|---|
| Risk | Low: the folder shows no harm; scanners have flagged the name |
| Symptoms | A folder in AppData\Local with tracking.ini; sometimes an antivirus or RogueKiller flag. No ads or redirects come from it |
| How to get rid of it | Delete the folder, or leave it; it returns whenever a setup with Installer Analytics runs again |
| Our check (6 October 2026) | No site test (there is no site). Read Caphyon's pages and forum reports from 2017 to 2023; we did not run a setup file ourselves |
| First seen / reported | June 2017 on Caphyon's forum; first reported by us 31 January 2019 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Distribution | With a legitimate setup file built with Installer Analytics; no hidden second program is described in any source |
|---|---|
| Damage | None found in any source: a small text file and a small amount of install data sent to Caphyon's service |
| Sends to | collect.installeranalytics.com; the domain installeranalytics.com was registered on 26 January 2015 |
| Programs seen creating it | NordVPN's setup (2017), FxSound (2023); a user also blamed AdwCleaner in 2018, not repeated by two other users |
| Detection names | No Microsoft detection name is known (searched 6 October 2026). Others: PUP.OnlineIO (RogueKiller, 2017), PUA:Win32/Traffic Exchange.F!Neg (a scanner in our 2019 picture) |
| File name | AdvinstAnalytics |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Caphyon's own pages and privacy notice and forum reports from Caphyon, ESET, BleepingComputer, Malwarebytes, FxSound and Microsoft. We did not run a setup file or a scan ourselves.
What the AdvinstAnalytics file is
What AdvinstAnalytics is
AdvinstAnalytics is a folder, not a program: %LocalAppData%\AdvinstAnalytics. A setup file built with Advanced Installer's Installer Analytics option creates it when you run the setup, and its only known content is a small text file called tracking.ini.
- 1
A software maker builds its setup with Advanced Installer
Advanced Installer is a tool from the Romanian company Caphyon for making Windows setup files. One of its options, Installer Analytics, lets the maker count how many people install, upgrade or remove the program.
- 2
You run the setup
Every package with Installer Analytics switched on sends information to Caphyon's servers, according to Caphyon's own forum answer. In one user's tests the folder appeared as soon as the setup file was opened, before anything was installed.
- 3
Windows gets a folder
Under
AppData\Localthe setup leavesAdvinstAnalytics, with a subfolder named like a long hexadecimal code, a subfolder named after a version, andtracking.iniinside.
- What it is
- A data folder left by installers that report their use to Caphyon's Installer Analytics service
- Where
C:\Users\<you>\AppData\Local\AdvinstAnalytics, in the user profile, not inProgram FilesorSystem32- What is inside
- Subfolders and a text file,
tracking.ini; in a sandbox test an ESET administrator saw only that file, containingActive = true - Who makes it
- Caphyon, the maker of Advanced Installer; the setup file belongs to whichever program you were installing
- Server contacted
collect.installeranalytics.com, with the user agentAdvinstAnalytics/1.0, as a company security team reported in 2017- Domain
installeranalytics.com, registered 26 January 2015 (RDAP)- Not a startup item
- No sign of a running process, a service or a startup entry in any source we read; the folder just sits there
The old version of this page called it an adware program that fills the screen with ads. We found nothing that supports that: no source shows a pop-up, a redirect, a changed home page or an extension coming from this folder. The name looks like malware because it ends in "Analytics" and appears on its own, which is also why scanners have flagged it.
It does report on the setup itself. Caphyon's privacy notice says the product collects the machine's hardware configuration (memory and graphics adapter settings), its software configuration (the Windows version, the Windows Installer version, the Windows user language) and the IP address, and that the last group of digits of the IP address is set to 0 before it is saved. The same notice says Caphyon does not sell or rent the end-user data. The old page said the program spies on your browsing sessions and surfing habits. Nothing in the notice or in the other sources mentions browsing data, so that part was wrong and is not repeated here.
What the reports show, and what we did not check
There is no website to test for this name, so we did not run a site test. This row-by-row summary comes from the vendor's own pages and from user and security-forum reports between 2017 and 2023, which we read on 6 October 2026.
Sources read on 6 October 2026
- Maker confirms the mechanismCaphyon's forum answer (June 2017): every package with Installer Analytics enabled sends information to its servers; with the option off, no traffic is generated.
- What the folder holdsESET forum (November 2022): an administrator ran a two-year-old installer in a virtual machine. It created only
tracking.iniwithActive = true, and VirusTotal showed 0 detections for the installer. - Programs seen creating itNordVPN's setup file (a user's tests in December 2017: it appeared after only opening
NordVPNSetup.exe, also on a second laptop) and FxSound (a user in July 2023, folder time matching the install time). A user also blamed AdwCleaner in January 2018; two Malwarebytes forum members could not repeat it, and staff said the file was safe. - Antivirus flagsRogueKiller listed the folder as
PUP.OnlineIO(December 2017). A scanner listing in our old guide called itPUA:Win32/Traffic Exchange.F!Neg. ESET said it detects adware only when it is malicious. - Not confirmedWhether every copy of
tracking.inihas the same content, and what each program's setup sends. We have not run a setup file with analytics ourselves.
Data folder, not a threat Nothing we read shows harm from the folder itself. This is a reading of reports, not a scan of your PC: it does not clear the setup file or anything else that arrived with it.
Is AdvinstAnalytics safe or a virus?
Three things made the name infamous: it appears without being asked for, it belongs to an analytics service, and a few scanners decided to flag it. None of that makes it adware.
June 2017
A security team questions the traffic
A company evaluating Advanced Installer reported that its security department saw traffic to
collect.installeranalytics.comwith the user agentAdvinstAnalytics/1.0, and asked whether it could be switched off. Caphyon answered that the traffic only exists in packages that enable Installer Analytics.December 2017
RogueKiller removes the folder, NordVPN's setup brings it back
A user's RogueKiller log listed the folder and
tracking.iniasPUP.OnlineIOand deleted them. The user then found they returned each time the NordVPN setup file was opened, and the helper on the forum replied that it would keep returning unless the installer offered a way not to install it.January 2018
Questions about AdwCleaner and Microsoft's answers page
A user saw the folder after an AdwCleaner scan and uploaded
tracking.inito VirusTotal, where the engines reported it clean. Another user asked on Microsoft's answers page why Microsoft's tools did not call it adware; the replies suggested a Windows Defender Offline scan, which returned no threats.2019
Our first guide calls it adware
This page was first published on 31 January 2019 and called the folder an ad-supported program. None of the sources we read supports its claims about ads, redirects and browser changes, so they are corrected below.
2022 to 2023
The question keeps coming back
ESET's forum (November 2022) and the FxSound forum (July 2023) each got the same question: a folder nobody remembers installing, and a web search saying adware. In the ESET thread a moderator pointed to NordVPN's installer as one source and said other installers could create it too.
| Who | What they said | Date |
|---|---|---|
| Caphyon (Advanced Installer) | The traffic exists only if Installer Analytics is enabled in the package | June 2017 |
| ESET forum administrator | Installer created only tracking.ini; 0 detections at VirusTotal; ESET detects adware only if malicious | November 2022 |
| Malwarebytes forum staff | The AdwCleaner binary a user blamed was checked and safe | January 2018 |
| RogueKiller | Listed the folder and file as PUP.OnlineIO | December 2017 |
| Scanner in our old guide | Labelled the folder PUA:Win32/Traffic Exchange.F!Neg | 2019 picture |
How to check the AdvinstAnalytics file
What antivirus programs call AdvinstAnalytics
Microsoft Defender reports AdvinstAnalytics as no Microsoft detection name is known.
In a Defender name, the part before the colon is the category, the part after it is the platform, and the part after the slash is the family Microsoft assigned. A suffix after ! is an internal Microsoft marker, not a different threat.
Generic labels such as Agent, GenericKD or Malware.AI only say that a file looks malicious, not what it does; our guide to antivirus detection names shows how to read them.
Check your own folder in two minutes
Do this on Windows 11 or Windows 10 when you want to be sure the folder is the harmless kind and see which program made it.
- 1
Open the folder
Press Windows + R, type
%LocalAppData%\AdvinstAnalyticsand press Enter. If Windows says the path does not exist, you do not have it. - 2
Look at what is inside
Expect one or more subfolders and a file named
tracking.ini. Right-click the file > Properties: it should be tiny. Open it with Notepad: it is plain text. - 3
Find the program behind it
In File Explorer choose View > Details and look at Date created. Match the date to when you ran a setup file or installed an app. The date you see on the subfolder is when the setup first ran, not when the program was last used.
- 4
Check the other names
Anything else in the folder, especially an
.exe,.dllor.batfile, does not fit what the sources describe. Right-click it > Properties > Digital Signatures, and scan it with Microsoft Defender or send it to VirusTotal.
What the folder can hold
- tracking.ini
- a subfolder named like a long hex code
- a subfolder named like a version number
Matches the paths seen in a 2017 RogueKiller log. We could not confirm that the hex code is the application ID Caphyon assigns to the maker's app; the format fits, but nothing we read says so.
Where AdvinstAnalytics comes from
The folder arrives with a legitimate setup file, not on its own. The ways real unwanted programs spread are different, and worth knowing, because the same advice protects you from both.
| AdvinstAnalytics folder | Real adware and unwanted programs | |
|---|---|---|
| How it arrives | Part of a setup file you ran, built with Installer Analytics | Bundled into free software, or into fake download buttons |
| What you see | A folder with a text file; no window, no ads | Ads, redirects, new toolbars, changed start page |
| Where it hides | %LocalAppData%\AdvinstAnalytics | Extensions, scheduled tasks, services, program folders |
| What it sends | Install counts, hardware and Windows details, a shortened IP address | Browsing habits, searches, clicks, sometimes more |
| What to do | Delete the folder or leave it | Uninstall the program, remove extensions, scan the PC |
- High
Bundling in free software
A free program ships with extra offers ticked by default. If you click through the quick setup, the extras are installed too.
- High
Torrent and file-sharing sites
Third-party download sites often carry cracks and repacked setups with unwanted additions, and have few protections for what they host.
- Medium
Ads and links on unsafe websites
Clicking an ad or a button on such a page can start a download you did not ask for, or open a page that pushes one.
- Medium
Fake update prompts
A page that says a player or browser must be updated is nearly always bait. Update from the program's own menu.
- Low
Legitimate setups with analytics
NordVPN's and FxSound's setups are legitimate; the folder in those cases came from the setup file, not from a hidden second program.
What to do with AdvinstAnalytics
How to remove AdvinstAnalytics
It is usually a leftover of an unwanted program.
Uninstall the program, then delete what remains.
Step 1: Uninstall programs you did not mean to install
AdvinstAnalytics rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after AdvinstAnalytics, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of AdvinstAnalytics that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Delete the folder or leave it
Deleting AdvinstAnalytics is safe and costs nothing, but it comes back the next time a setup built with Installer Analytics runs. Leaving it alone is also fine.
- 1
Close setups and installers
Close any setup window or installer that is open, so Windows does not say the file is in use.
- 2
Open and delete
Press Windows + R, type
%LocalAppData%and press Enter. Right-click theAdvinstAnalyticsfolder > Delete. Empty the Recycle Bin if you want it gone from the disk. - 3
Do not use a registry cleaner
The sources show no registry entry, service or startup item for this name, so there is nothing to clean there. Cleaners that promise to remove it are not needed.
- 4
Scan once with Microsoft Defender
Open Windows Security > Virus & threat protection > Scan options > Full scan. This is for everything else the setup file may have installed, not for this folder.
- Low
It returns after a new setup
In December 2017 a user's folder came back every time NordVPN's setup file was opened. A folder that returns after you delete it means a setup file ran again, not that the first removal failed.
- Low
Uninstalling the program may not remove it
The sources do not say whether an uninstaller removes the folder, so treat it as a leftover and delete it yourself.
- Medium
Editing
tracking.iniis not a fixOne forum user changed the value from true to false in the file. We could not confirm that this stops reports, so do not count on it.
Do
- Keep a note of which setup file made the folder; that setup is the real subject.
- Update Windows and your security tool as usual.
- If you manage company PCs, ask the software maker whether Installer Analytics is on in their package.
Don't
- Run a "cleanup" tool or paid scanner only because of this folder name.
- Delete anything in
Program FilesorSystem32while looking for it. - Block
collect.installeranalytics.comon a home PC and expect other effects. Blocking the host is an option for network administrators; we did not test it.
If you really have ads, redirects or a changed browser
The folder does not cause those symptoms in any source we read. If your browser is showing ads, sending you to other sites or has a changed start page, the cause is something else on the PC, and the steps below find it.
- High
Redirects and ads from a rogue extension
A browser extension or an app injected into the browser is the usual source. It changes the start page and new tab address, and fills pages with ads.
- Medium
Pop-ups from a site's notification permission
You may have clicked Allow on a page. The page keeps sending notifications until you remove the permission in the browser.
- Medium
Dangerous pages behind the ads
Ads on unsafe sites can lead to pages that spread a Trojan or ransomware. Do not click them.
- Low
A crashing browser
A crash is usually an extension or a damaged profile, and it is fixed by removing the extension or resetting the browser.
- 1
Remove recently installed apps
Windows 11: Settings > Apps > Installed apps, sort by Install date. Windows 10: Settings > Apps > Apps & features, sort by Install date. Uninstall what you did not choose to install.
- 2
Check the extensions
Chrome: open
chrome://extensions. Edge:edge://extensions. Firefox:about:addons. Remove each one you did not install or do not use. - 3
Check the start page and search engine
Chrome: Settings > On startup and Search engine. Edge: Settings > Start, home, and new tabs and Privacy, search, and services. Firefox: Settings > Home and Search.
- 4
Remove notification permissions
Chrome and Edge: Settings > Privacy and security (or Cookies and site permissions) > Site settings > Notifications. Firefox: Settings > Privacy & Security > Permissions > Notifications > Settings. Remove the sites you do not know.
- 5
Reset a browser that is still wrong
Chrome and Edge have Reset settings in their settings; Firefox has Refresh Firefox on
about:support. This also turns off extensions. Internet Explorer was retired in 2022, and there is nothing to reset there.
These steps work for Chrome, Edge and Firefox on Windows. Safari and macOS need other steps, and this folder does not exist on a Mac: Caphyon's tool builds Windows setup files, and every source we read is about Windows.
After the check: keep Windows clean
Do
- Download programs only from the maker's own site or the Microsoft Store, and use the original installer.
- Choose Custom or Advanced setup in an installer and untick extra offers, so nothing slips in unseen.
- Look a program up before you install it: its maker, reviews and a scan result.
- Keep Windows Security, SmartScreen and automatic Windows Update on.
- Keep a current backup of your files (File History or OneDrive), so a bad install never costs you anything.
- Use a VPN only from a maker you trust; a VPN setup is itself a program you run.
Don't
- Download cracks, key generators or files from unknown torrent pages.
- Click ads or buttons that offer a different download than the one you wanted.
- Allow notifications from a site you do not know.
- Run a setup from an e-mail or pop-up that says your player needs an update.
Questions about AdvinstAnalytics
What is AdvinstAnalytics?
AdvinstAnalytics is a folder in %LocalAppData% that setup files built with Advanced Installer's Installer Analytics option leave on your PC. Installer Analytics lets a software maker count installs, upgrades and removals of its program. The folder usually holds a subfolder with a long hexadecimal name, a subfolder named like a version, and a small text file called tracking.ini.
Reports link it to setups such as NordVPN's (2017) and FxSound's (2023). It is not an application you installed, it does not run on its own in any report we read, and it does not show ads.
Is AdvinstAnalytics a virus or adware?
No source we read shows it behaving as a virus or as adware. It is a folder made by an installer's analytics feature, and in an ESET administrator's virtual-machine test it contained only tracking.ini with Active = true.
Some scanners have flagged the name as a potentially unwanted program, for example RogueKiller as PUP.OnlineIO in 2017, but a flag is a scanner's decision, not behaviour. ESET said it detects adware only if it is malicious. One visit or one scan does not clear a PC, so if you have ads or redirects, look for another cause.
Why is AdvinstAnalytics in my AppData Local folder?
You, or someone using your PC, ran a setup file built with Installer Analytics enabled. The folder is created in the profile that ran the setup. In 2017 a user found it after only opening NordVPNSetup.exe, without finishing the install, and in 2023 an FxSound user saw its time match the FxSound install.
To find your own cause, open the folder, sort File Explorer by Date created, and match the date with a program you installed or updated around then. If nothing matches, an app that updated itself in the background is the next suspect.
Is it safe to delete the AdvinstAnalytics folder?
Yes, it is safe to delete. It is a data folder in your user profile, and no source shows a program that needs it to run. Press Windows + R, type %LocalAppData%, press Enter, then right-click AdvinstAnalytics and choose Delete.
Do not delete anything in Program Files or System32 while looking for it. Deleting it does not affect Windows, your browsers or the program whose setup made it. Expect it to come back if you run another setup that has Installer Analytics enabled; the sources do not say whether a program's uninstaller removes it.
Why does AdvinstAnalytics keep coming back?
It comes back because a setup built with Installer Analytics ran again. A user in December 2017 deleted it with RogueKiller, and it returned every time he opened NordVPN's setup file, on his sister's laptop too. A forum helper answered that it would return unless the installer offered a way to decline.
For a user there is no switch in Windows. A software maker can turn the option off in its package, and Caphyon's answer to a customer in 2017 says that without the option no traffic is generated.
Does AdvinstAnalytics cause pop-ups, redirects or a changed homepage?
No report we read ties the folder to pop-ups, redirects, a new start page or extensions. Our old guide claimed all of these, and we could not support any of them. If your browser behaves like that, the cause is another program or a browser extension.
Check Settings > Apps > Installed apps sorted by install date, then your browser's extensions, start page and notification permissions, as in the plan above. A removal tool that only deletes this folder will not stop real ads, because the folder is not producing them.
What does AdvinstAnalytics send, and to where?
The setup reports to Caphyon's Installer Analytics service, and a 2017 forum post names the host collect.installeranalytics.com with the user agent AdvinstAnalytics/1.0. Caphyon's privacy notice says it collects hardware configuration (memory, graphics adapter), software configuration (Windows version, Windows Installer version, user language) and the IP address, with the last group of digits set to 0 before storing.
It says it does not sell or rent end-user data. It lists events such as install, uninstall, upgrade and patch. Nothing about your browsing is listed.
Why does my antivirus detect it, or not detect it?
Detections are a matter of each vendor's policy. RogueKiller listed the folder as PUP.OnlineIO in 2017 and a scanner shown in our old guide labelled it PUA:Win32/Traffic Exchange.F!Neg. Microsoft's Windows Defender Offline scan, suggested to a user on Microsoft's answers page in 2018, reported no threats, and ESET said it flags adware only when it is malicious.
VirusTotal showed 0 detections for the installer ESET looked at. A flag or a clean result says little here: look at what the folder holds and where it came from.
Is there an AdvinstAnalytics folder on a Mac, and what about Safari and Internet Explorer?
No source describes one on a Mac. The folder comes from Advanced Installer's Windows setup files, so a Mac with ads has a different problem, and Safari needs Safari's own steps.
Our old guide listed Chrome, Firefox, Edge, Internet Explorer and Safari as affected, and none of them is: the folder is not in a browser. Internet Explorer was retired in 2022. For Chrome, Edge and Firefox on Windows, use the extension, start page and notification checks in the plan above if you see ads.
Will Fortect remove AdvinstAnalytics?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For AdvinstAnalytics, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Advanced Installer forum: Security issue with User-Agent AdvinstAnalytics/1.0 (read October 6, 2026)
- Advanced Installer: Installer Analytics (read October 6, 2026)
- Advanced Installer: Installer Analytics FAQ (read October 6, 2026)
- Installer Analytics: Privacy Policy (Caphyon) (read October 6, 2026)
- ESET Security Forum: AdvinstAnalytics Question? (read October 6, 2026)
- BleepingComputer forum: RogueKiller Found AdvinstAnalytics (read October 6, 2026)
- Malwarebytes forum: I think that the new Adwcleaner installs the pup (advinstanalytics) (read October 6, 2026)
- FxSound forum: AdvinstAnalytics Folder (read October 6, 2026)
- Microsoft Q&A: Should I have AdvinstAnalystics under Local App Data? (read October 6, 2026)
- RDAP registration data: installeranalytics.com (read October 6, 2026)
- Microsoft Support: Uninstall or remove apps and programs in Windows (read October 6, 2026)
- Microsoft Support: Stay protected with Windows Security (read October 6, 2026)