[Jonesey]

Hi guys, hope someone can spare a little time to advise me about a text file I found today simply by browsing through Windows Explorer.

It's located right under the root of C:\, in a folder called:

C:\4eaf9c68f831094e4c1af1772840e4

The filename is:

msxml4-KB927978-enu.txt

It's 251Kb in size and runs to about 1250 lines.

It appeared on my system yesterday at 15:30 - I was in work so can only assume that it happened when my stepson was using it in the afternoon.

I am the administrator of the system, he doesn't have sufficient privileges to do too much damage, but the text does contain what looks to me like modifications to the registry, so I'm naturally a bit nervous about it.

I can't upload a file with a .txt extension, so I've posted a few of the first lines below.

Is this enough?

If someone could advise me whether it's something I can safely ignore/delete, or if I need to take any further action, I'd be really grateful.

Many thanks.
Jonesey

--------------------------------------------------------------------------------------------------------------

=== Verbose logging started: 16/11/2006 15:32:27 Build type: SHIP UNICODE 3.01.4000.2435 Calling process: C:\WINNT\system32\msiexec.exe ===
MSI © (50:04) [15:32:27:304]: Resetting cached policy values
MSI © (50:04) [15:32:27:304]: Machine policy value 'Debug' is 0
MSI © (50:04) [15:32:27:304]: ******* RunEngine:
******* Product: c:\4eaf9c68f831094e4c1af1772840e4\msxml.msi
******* Action:
******* CommandLine: **********
MSI © (50:04) [15:32:27:304]: Client-side and UI is none or basic: Running entire install on the server.
MSI © (50:04) [15:32:27:314]: Grabbed execution mutex.
MSI © (50:04) [15:32:27:444]: Cloaking enabled.
MSI © (50:04) [15:32:27:444]: Attempting to enable all disabled priveleges before calling Install on Server
MSI © (50:04) [15:32:27:464]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (74:98) [15:32:27:494]: Grabbed execution mutex.
MSI (s) (74:EC) [15:32:27:494]: Resetting cached policy values
MSI (s) (74:EC) [15:32:27:494]: Machine policy value 'Debug' is 0
MSI (s) (74:EC) [15:32:27:494]: ******* RunEngine:
******* Product: c:\4eaf9c68f831094e4c1af1772840e4\msxml.msi
******* Action:

[Advertisements]

msxml4-KB927978-enu.txt

the file name itself suggests that it's a microsoft update of some kind...possibly an update log from an update install

C:\4eaf9c68f831094e4c1af1772840e4

the location looks similar to the folder type that a service pack (or update) administrative install would create (a service pack administrative install is when you actually download the file and run it...instead of letting windows update install it for you)

[dsenette]

msxml4-KB927978-enu.txt

the file name itself suggests that it's a microsoft update of some kind...possibly an update log from an update install

C:\4eaf9c68f831094e4c1af1772840e4

the location looks similar to the folder type that a service pack (or update) administrative install would create (a service pack administrative install is when you actually download the file and run it...instead of letting windows update install it for you)

[dsenette]

http://www.microsoft...n/MS06-071.mspx in fact..here's that kb update on microsoft's website...and it does refer to msxml

[Jonesey]

Thanks for the quick response!!

I do have this sytem set up to download automatic updates from Microsoft, so that probably explains it!

Thanks again for such a quick answer - you wouldn't want them all to be this simple though, life would get boring!