It's located right under the root of C:\, in a folder called:
C:\4eaf9c68f831094e4c1af1772840e4
The filename is:
msxml4-KB927978-enu.txt
It's 251Kb in size and runs to about 1250 lines.
It appeared on my system yesterday at 15:30 - I was in work so can only assume that it happened when my stepson was using it in the afternoon.
I am the administrator of the system, he doesn't have sufficient privileges to do too much damage, but the text does contain what looks to me like modifications to the registry, so I'm naturally a bit nervous about it.
I can't upload a file with a .txt extension, so I've posted a few of the first lines below.
Is this enough?
If someone could advise me whether it's something I can safely ignore/delete, or if I need to take any further action, I'd be really grateful.
Many thanks.
Jonesey
--------------------------------------------------------------------------------------------------------------
=== Verbose logging started: 16/11/2006 15:32:27 Build type: SHIP UNICODE 3.01.4000.2435 Calling process: C:\WINNT\system32\msiexec.exe ===
MSI © (50:04) [15:32:27:304]: Resetting cached policy values
MSI © (50:04) [15:32:27:304]: Machine policy value 'Debug' is 0
MSI © (50:04) [15:32:27:304]: ******* RunEngine:
******* Product: c:\4eaf9c68f831094e4c1af1772840e4\msxml.msi
******* Action:
******* CommandLine: **********
MSI © (50:04) [15:32:27:304]: Client-side and UI is none or basic: Running entire install on the server.
MSI © (50:04) [15:32:27:314]: Grabbed execution mutex.
MSI © (50:04) [15:32:27:444]: Cloaking enabled.
MSI © (50:04) [15:32:27:444]: Attempting to enable all disabled priveleges before calling Install on Server
MSI © (50:04) [15:32:27:464]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (74:98) [15:32:27:494]: Grabbed execution mutex.
MSI (s) (74:EC) [15:32:27:494]: Resetting cached policy values
MSI (s) (74:EC) [15:32:27:494]: Machine policy value 'Debug' is 0
MSI (s) (74:EC) [15:32:27:494]: ******* RunEngine:
******* Product: c:\4eaf9c68f831094e4c1af1772840e4\msxml.msi
******* Action: