redline
Topic Starter
Hi,
I have run Sbybot and Panda and deleted the couple of files they found. But they were mostly cookies. I have McAfee Internet Security installed and on automactic updates.
About 1 month ago, my computer started receiving/generating the following log files. I get about 1 per day. Listed below is an example of one.
I tried to 'restore' back to 11/18/06 (when I first started seeing these files), but by computer would only go back to 12/1/06.
I have listed the Hijack log below.
Any suggestions to solve the issue? Thanks!
Logfile of HijackThis v1.99.1Scan saved at 12:14:25 PM, on 1/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SiteAdvisor\4979\SAService.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\Program Files\Sony\Photo Server\appsrv\PhotoAppSrv.exe
C:\Program Files\Sony\Giga Pocket\GPVSvr.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\WScript.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SiteAdvisor\4979\SiteAdv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony\USBSircs\usbsircs.exe
C:\Program Files\Sony\Giga Pocket\reservemodule.exe
C:\Program Files\Sony\Giga Pocket\gps.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vb script: C:\WINDOWS\Installer\MSI1A.tmp
MSI (s) (5C:C8) [08:06:40:796]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (5C:C8) [08:06:40:812]: Machine policy value 'DisableRollback' is 0
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=896876757,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 8:06:40: InstallFinalize.
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ProductInfo(ProductKey={37477865-A3F1-4772-AD43-AAFC6BCFF99F},ProductName=MSXML 4.0 SP2 (KB927978),PackageName=msxml.msi,Language=1033,Version=68429425,Assignment=1,ObsoleteArg=0,,,PackageCode={2B27DCD9-53FA-4885-B6CD-698623819F4C},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: DialogInfo(Type=1,Argument=MSXML 4.0 SP2 (KB927978))
MSI (s) (5C:C8) [08:06:40:828]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (5C:C8) [08:06:40:828]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ProgressTotal(Total=5,Type=1,ByteEquivalent=24000)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={E9BC82F6-AC0E-407C-8666-619D6D60DF2B},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\6F28CB9EE0CAC704686616D9D606FDB2 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\6F28CB9EE0CAC704686616D9D606FDB2 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={81754FFD-DA2B-49C6-9447-E1C1E1733BB6},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\DFF45718B2AD6C9449741E1C1E37B36B 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\DFF45718B2AD6C9449741E1C1E37B36B 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={5E6714E1-EA46-4B0F-B479-06D87058DC74},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\1E4176E564AEF0B44B97608D0785CD47 3: 2
MSI (s) (5C:C8) [08:06:40:843]: Note: 1: 1402 2: UNKNOWN\Components\1E4176E564AEF0B44B97608D0785CD47 3: 2
MSI (s) (5C:C8) [08:06:40:843]: Executing op: ComponentUnregister(ComponentId={57E0F99D-E884-4BD0-B8CB-803CF9EA2066},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:843]: Note: 1: 1402 2: D6B9ABF34537},KeyPath=02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\downlevel_manifest\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={DA6654F6-456F-3658-B06B-D6B9ABF34537},KeyPath=02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\downlevel_payload\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={0E9F98FC-A692-A6DF-A06B-D6B9ABF34537},,State=-7,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={0E9F98FC-A692-A6DF-C06B-) [08:06:40:875]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTick()
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTick()
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=RemoveODBC,Description=Removing ODBC components,)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ODBCDriverManager(,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ODBCDriverManager(,BinaryType=1)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])
MSI (s) (5C:C8) [08:06:40:875]: Executing op: FolderCreate(Folder=C:\Program Files\MSXML 4.0\,Foreign=0,)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTotal(Total=1245696,Type=0,ByteEquivalent=1)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\system32\)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: SetSourceFolder(Folder=1\System\)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,MediaCabinet=XML_Core.cab,BytesPerTick=32768,CopierType=2,ModuleFileName=C:\WINDOWS\Installer\7296d6.msi,,,,,IsFirstPhysicalMedia=1)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: FileCopy(SourceName=msxml4.dll,SourceCabKey=msxml4.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7,DestName=msxml4.dll,Attributes=512,FileSize=1245696,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.20.9841.0,Language=0,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:40:890]: File: C:\WINDOWS\system32\msxml4.dll; Overwrite; Won't patch; Existing file is a lower version
MSI (s) (5C:C8) [08:06:40:890]: Source for file 'msxml4.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7' is compressed
MSI (s) (5C:C8) [08:06:40:890]: Re-applying security from existing file.
MSI (s) (5C:C8) [08:06:40:890]: Verifying accessibility of file: msxml4.dll
MSI (s) (5C:C8) [08:06:40:906]: SOFTWARE RESTRICTION POLICY: Verifying object –> 'C:\WINDOWS\Installer\7296d6.msi' against software restriction policy
MSI (s) (5C:C8) [08:06:40:906]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\7296d6.msi has a digital signature
MSI (s) (5C:C8) [08:06:40:968]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\7296d6.msi is permitted to run at the 'unrestricted' authorization level.
MSI (s) (5C:C8) [08:06:40:968]: Note: 1: 2318 2: C:\WINDOWS\system32\msxml4.dll
MSI (s) (5C:C8) [08:06:40:968]: Note: 1: 2360
MSI (s) (5C:C8) [08:06:41:015]: Note: 1: 2360
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=msxml4r.dll,SourceCabKey=msxml4r.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7,DestName=msxml4r.dll,Attributes=512,FileSize=82432,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.10.9404.0,Language=1033,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\system32\msxml4r.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\manifest\|Windows\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=xl34x2va.rt8|x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest,SourceCabKey=manifest.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest,,FileSize=3973,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-85909274,HashPart2=-393638470,HashPart3=495071453,HashPart4=945762879,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=yl34x2va.rt8|x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat,SourceCabKey=catalog.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat,,FileSize=8347,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1679697816,HashPart2=1808584787,HashPart3=1425912084,HashPart4=629236904,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\tl34x2va.rt8\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=1m34x2va.rt8|msxml4.dll,SourceCabKey=msxml4.dll.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=msxml4.dll,,FileSize=1245696,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,Version=4.20.9841.0,Language=0,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\msxml4.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\manifest\|Windows\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=9n0mtfut.k85|x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest,SourceCabKey=manifest.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest,,FileSize=500,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-707213148,HashPart2=1938794768,HashPart3=-933075776,HashPart4=-843550219,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=an0mtfut.k85|x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat,SourceCabKey=catalog.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat,,FileSize=8349,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1336197992,HashPart2=-627824155,HashPart3=82633343,HashPart4=1105156543,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\5n0mtfut.k85\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=dn0mtfut.k85|msxml4r.dll,SourceCabKey=msxml4r.dll.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=msxml4r.dll,,FileSize=82432,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,Version=4.10.9404.0,Language=1033,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\Policies\i0r1wg7y.dqe\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=l0r1wg7y.dqe|4.20.9841.0.policy,SourceCabKey=manifest.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537,DestName=4.20.9841.0.policy,,FileSize=652,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=49613189,HashPart2=1139053242,HashPart3=-1699064514,HashPart4=-854272932,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9841.0.policy; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=m0r1wg7y.dqe|4.20.9841.0.cat,SourceCabKey=catalog.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537,DestName=4.20.9841.0.cat,,FileSize=8359,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-861819424,HashPart2=1423527147,HashPart3=-1146259424,HashPart4=2040409349,,)
MSI (s) (5C:C8) [08:06:41:062]: File: C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9841.0.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,MediaCabinet=XML_SDK.cab,BytesPerTick=32768,CopierType=2,ModuleFileName=C:\WINDOWS\Installer\7296d6.msi,,,,,IsFirstPhysicalMedia=1)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: CacheSizeFlush(,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: InstallProtectedFiles(AllowUI=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ProgressTotal(Total=112,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5},,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=C:\WINDOWS\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\Version,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value={F5078F18-C551-11D3-89B9-0000F81FE221},)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0\CLSID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value={88D969C0-F192-11D4-A65F-0040963251E5},)
MSI (s) (5C:C8) [08:06:41:062]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID 3: 5
MSI (s) (5C:C8) [08:06:41:062]: Product: MSXML 4.0 SP2 (KB927978) – Error 1402. Could not open key: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID. System error 5. Verify that you have sufficient access to that key, or contact your support personnel.
Error 1402. Could not open key: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID. System error 5. Verify that you have sufficient access to that key, or contact your support personnel.
MSI (s) (5C:C8) [08:06:41:078]: User policy value 'DisableRollback' is 0
MSI (s) (5C:C8) [08:06:41:078]: Machine policy value 'DisableRollback' is 0
Action ended 8:06:41: InstallFinalize. Return value 3.
MSI (s) (5C:C8) [08:06:41:078]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=896876757,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: DialogInfo(Type=1,Argument=MSXML 4.0 SP2 (KB927978))
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegisterBackupFile(File=C:\Config.Msi\7296db.rbf)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0\CLSID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: ProductInfo(ProductKey={37477865-A3F1-4772-AD43-AAFC6BCFF99F},ProductName=MSXML 4.0 SP2 (KB927978),PackageName=msxml.msi,Language=1033,Version=68429425,Assignment=1,ObsoleteArg=0,,,PackageCode={2B27DCD9-53FA-4885-B6CD-698623819F4C},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegRemoveValue(,Value={F5078F18-C551-11D3-89B9-0000F81FE221},)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegAddValue(,Value={f5078f18-c551-11d3-89b9-0000f81fe221},)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\Version,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegRemoveValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegAddValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegRemoveValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegAddValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegRemoveValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegRemoveValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:125]: Executing op: RegAddValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegRemoveValue(,Value=C:\WINDOWS\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegAddValue(,Value=#%%SystemRoot%\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5},,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegRemoveValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\system32\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: FileCopy(SourceName=C:\Config.Msi\7296db.rbf,,DestName=C:\WINDOWS\system32\msxml4.dll,Attributes=32800,FileSize=1230336,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (5C:C8) [08:06:41:140]: File: C:\WINDOWS\system32\msxml4.dll; Overwrite; Won't patch; REINSTALLMODE specifies all files to be overwritten
MSI (s) (5C:C8) [08:06:41:156]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])
MSI (s) (5C:C8) [08:06:41:156]: Executing op: FolderRemove(Folder=C:\Program Files\MSXML 4.0\,Foreign=0)
MSI (s) (5C:C8) [08:06:41:171]: Executing op: ActionStart(Name=RemoveODBC,Description=Removing ODBC components,)
Property(S): WinSxsPolicies.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Policies\
Property(S): policydir.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\
Property(S): WindowsFolder.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\
Property(S): SystemFolder.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\system32\
Property(S): WinSxsManifests.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Manifests\
Property(S): payload.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_ff05e224\
Property(S): policydir_ul.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_ff05e224\
Property(S): DesktopFolder.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Desktop\
Property(S): ProgramMenuFolder.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Start Menu\Programs\
Property(S): MenuMSXML.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Start Menu\Programs\MSXML 4.0\
Property(S): DOC.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\doc\
Property(S): LIB.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\lib\
Property(S): INC.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\inc\
Property(S): CommonFilesFolder = C:\Program Files\Common Files\
Property(S): MicrosoftShared.3FB7DAB3_19E7_40A0_8730_4482CE77AC59 = C:\Program Files\Common
Property(S): SOURCEDIR = d:\0bf1cf5dc08b21e680bffdcd\
Property(S): SourcedirProduct = {37477865-A3F1-4772-AD43-AAFC6BCFF99F}
Property(S): ProductToBeRegistered = 1
MSI (s) (5C:C8) [08:06:41:312]: Note: 1: 1708
MSI (s) (5C:C8) [08:06:41:312]: Product: MSXML 4.0 SP2 (KB927978) – Installation failed.
MSI (s) (5C:C8) [08:06:41:312]: Cleaning up uninstalled install packages, if any exist
MSI (s) (5C:C8) [08:06:41:312]: MainEngineThread is returning 1603
MSI (s) (5C:20) [08:06:41:421]: Destroying RemoteAPI object.
MSI (s) (5C:B0) [08:06:41:437]: Custom Action Manager thread ending.
=== Logging stopped: 11/21/2006 8:06:41 ===
MSI © (EC:58) [08:06:41:437]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI © (EC:58) [08:06:41:437]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/21/2006 8:06:41 ===
Thanks everyone!!
I have run Sbybot and Panda and deleted the couple of files they found. But they were mostly cookies. I have McAfee Internet Security installed and on automactic updates.
About 1 month ago, my computer started receiving/generating the following log files. I get about 1 per day. Listed below is an example of one.
I tried to 'restore' back to 11/18/06 (when I first started seeing these files), but by computer would only go back to 12/1/06.
I have listed the Hijack log below.
Any suggestions to solve the issue? Thanks!
Logfile of HijackThis v1.99.1Scan saved at 12:14:25 PM, on 1/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SiteAdvisor\4979\SAService.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\Program Files\Sony\Photo Server\appsrv\PhotoAppSrv.exe
C:\Program Files\Sony\Giga Pocket\GPVSvr.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\WScript.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SiteAdvisor\4979\SiteAdv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony\USBSircs\usbsircs.exe
C:\Program Files\Sony\Giga Pocket\reservemodule.exe
C:\Program Files\Sony\Giga Pocket\gps.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vb script: C:\WINDOWS\Installer\MSI1A.tmp
MSI (s) (5C:C8) [08:06:40:796]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (5C:C8) [08:06:40:812]: Machine policy value 'DisableRollback' is 0
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=896876757,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 8:06:40: InstallFinalize.
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ProductInfo(ProductKey={37477865-A3F1-4772-AD43-AAFC6BCFF99F},ProductName=MSXML 4.0 SP2 (KB927978),PackageName=msxml.msi,Language=1033,Version=68429425,Assignment=1,ObsoleteArg=0,,,PackageCode={2B27DCD9-53FA-4885-B6CD-698623819F4C},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: DialogInfo(Type=1,Argument=MSXML 4.0 SP2 (KB927978))
MSI (s) (5C:C8) [08:06:40:828]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (5C:C8) [08:06:40:828]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ProgressTotal(Total=5,Type=1,ByteEquivalent=24000)
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={E9BC82F6-AC0E-407C-8666-619D6D60DF2B},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\6F28CB9EE0CAC704686616D9D606FDB2 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\6F28CB9EE0CAC704686616D9D606FDB2 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={81754FFD-DA2B-49C6-9447-E1C1E1733BB6},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\DFF45718B2AD6C9449741E1C1E37B36B 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\DFF45718B2AD6C9449741E1C1E37B36B 3: 2
MSI (s) (5C:C8) [08:06:40:828]: Executing op: ComponentUnregister(ComponentId={5E6714E1-EA46-4B0F-B479-06D87058DC74},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:828]: Note: 1: 1402 2: UNKNOWN\Components\1E4176E564AEF0B44B97608D0785CD47 3: 2
MSI (s) (5C:C8) [08:06:40:843]: Note: 1: 1402 2: UNKNOWN\Components\1E4176E564AEF0B44B97608D0785CD47 3: 2
MSI (s) (5C:C8) [08:06:40:843]: Executing op: ComponentUnregister(ComponentId={57E0F99D-E884-4BD0-B8CB-803CF9EA2066},,BinaryType=0,PreviouslyPinned=1)
MSI (s) (5C:C8) [08:06:40:843]: Note: 1: 1402 2: D6B9ABF34537},KeyPath=02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\downlevel_manifest\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={DA6654F6-456F-3658-B06B-D6B9ABF34537},KeyPath=02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\downlevel_payload\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={0E9F98FC-A692-A6DF-A06B-D6B9ABF34537},,State=-7,,Disk=1,SharedDllRefCount=0,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ComponentRegister(ComponentId={0E9F98FC-A692-A6DF-C06B-) [08:06:40:875]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTick()
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTick()
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=RemoveODBC,Description=Removing ODBC components,)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ODBCDriverManager(,BinaryType=0)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ODBCDriverManager(,BinaryType=1)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])
MSI (s) (5C:C8) [08:06:40:875]: Executing op: FolderCreate(Folder=C:\Program Files\MSXML 4.0\,Foreign=0,)
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])
MSI (s) (5C:C8) [08:06:40:875]: Executing op: ProgressTotal(Total=1245696,Type=0,ByteEquivalent=1)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\system32\)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: SetSourceFolder(Folder=1\System\)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,MediaCabinet=XML_Core.cab,BytesPerTick=32768,CopierType=2,ModuleFileName=C:\WINDOWS\Installer\7296d6.msi,,,,,IsFirstPhysicalMedia=1)
MSI (s) (5C:C8) [08:06:40:890]: Executing op: FileCopy(SourceName=msxml4.dll,SourceCabKey=msxml4.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7,DestName=msxml4.dll,Attributes=512,FileSize=1245696,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.20.9841.0,Language=0,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:40:890]: File: C:\WINDOWS\system32\msxml4.dll; Overwrite; Won't patch; Existing file is a lower version
MSI (s) (5C:C8) [08:06:40:890]: Source for file 'msxml4.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7' is compressed
MSI (s) (5C:C8) [08:06:40:890]: Re-applying security from existing file.
MSI (s) (5C:C8) [08:06:40:890]: Verifying accessibility of file: msxml4.dll
MSI (s) (5C:C8) [08:06:40:906]: SOFTWARE RESTRICTION POLICY: Verifying object –> 'C:\WINDOWS\Installer\7296d6.msi' against software restriction policy
MSI (s) (5C:C8) [08:06:40:906]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\7296d6.msi has a digital signature
MSI (s) (5C:C8) [08:06:40:968]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\7296d6.msi is permitted to run at the 'unrestricted' authorization level.
MSI (s) (5C:C8) [08:06:40:968]: Note: 1: 2318 2: C:\WINDOWS\system32\msxml4.dll
MSI (s) (5C:C8) [08:06:40:968]: Note: 1: 2360
MSI (s) (5C:C8) [08:06:41:015]: Note: 1: 2360
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=msxml4r.dll,SourceCabKey=msxml4r.dll.246EB7AD_459A_4FA8_83D1_41A46D7634B7,DestName=msxml4r.dll,Attributes=512,FileSize=82432,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.10.9404.0,Language=1033,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\system32\msxml4r.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\manifest\|Windows\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=xl34x2va.rt8|x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest,SourceCabKey=manifest.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest,,FileSize=3973,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-85909274,HashPart2=-393638470,HashPart3=495071453,HashPart4=945762879,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.manifest; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=yl34x2va.rt8|x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat,SourceCabKey=catalog.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat,,FileSize=8347,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1679697816,HashPart2=1808584787,HashPart3=1425912084,HashPart4=629236904,,)
MSI (s) (5C:C8) [08:06:41:031]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\tl34x2va.rt8\)
MSI (s) (5C:C8) [08:06:41:031]: Executing op: FileCopy(SourceName=1m34x2va.rt8|msxml4.dll,SourceCabKey=msxml4.dll.7B2FCEFF_0F22_B7E1_FF6B_D6B9ABF34537,DestName=msxml4.dll,,FileSize=1245696,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,Version=4.20.9841.0,Language=0,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\msxml4.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\manifest\|Windows\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=9n0mtfut.k85|x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest,SourceCabKey=manifest.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest,,FileSize=500,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-707213148,HashPart2=1938794768,HashPart3=-933075776,HashPart4=-843550219,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.manifest; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=an0mtfut.k85|x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat,SourceCabKey=catalog.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat,,FileSize=8349,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1336197992,HashPart2=-627824155,HashPart3=82633343,HashPart4=1105156543,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\5n0mtfut.k85\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=dn0mtfut.k85|msxml4r.dll,SourceCabKey=msxml4r.dll.DA6654F6_456F_3658_FF6B_D6B9ABF34537,DestName=msxml4r.dll,,FileSize=82432,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,Version=4.10.9404.0,Language=1033,InstallMode=58982400,,,,,,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll; Won't Overwrite; Won't patch; Existing file is of an equal version
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: SetSourceFolder(Folder=1\Windows\winsxs\Policies\i0r1wg7y.dqe\)
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=l0r1wg7y.dqe|4.20.9841.0.policy,SourceCabKey=manifest.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537,DestName=4.20.9841.0.policy,,FileSize=652,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=49613189,HashPart2=1139053242,HashPart3=-1699064514,HashPart4=-854272932,,)
MSI (s) (5C:C8) [08:06:41:046]: File: C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9841.0.policy; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:046]: Executing op: FileCopy(SourceName=m0r1wg7y.dqe|4.20.9841.0.cat,SourceCabKey=catalog.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537,DestName=4.20.9841.0.cat,,FileSize=8359,PerTick=32768,,VerifyMedia=1,ElevateFlags=4,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-861819424,HashPart2=1423527147,HashPart3=-1146259424,HashPart4=2040409349,,)
MSI (s) (5C:C8) [08:06:41:062]: File: C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9841.0.cat; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source file
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,MediaCabinet=XML_SDK.cab,BytesPerTick=32768,CopierType=2,ModuleFileName=C:\WINDOWS\Installer\7296d6.msi,,,,,IsFirstPhysicalMedia=1)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: CacheSizeFlush(,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: InstallProtectedFiles(AllowUI=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])
MSI (s) (5C:C8) [08:06:41:062]: Executing op: ProgressTotal(Total=112,Type=1,ByteEquivalent=13200)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5},,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=C:\WINDOWS\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\Version,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value={F5078F18-C551-11D3-89B9-0000F81FE221},)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0\CLSID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:062]: Executing op: RegAddValue(,Value={88D969C0-F192-11D4-A65F-0040963251E5},)
MSI (s) (5C:C8) [08:06:41:062]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID 3: 5
MSI (s) (5C:C8) [08:06:41:062]: Product: MSXML 4.0 SP2 (KB927978) – Error 1402. Could not open key: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID. System error 5. Verify that you have sufficient access to that key, or contact your support personnel.
Error 1402. Could not open key: HKEY_LOCAL_MACHINE\Software\Classes\Msxml2.DOMDocument.4.0\CLSID. System error 5. Verify that you have sufficient access to that key, or contact your support personnel.
MSI (s) (5C:C8) [08:06:41:078]: User policy value 'DisableRollback' is 0
MSI (s) (5C:C8) [08:06:41:078]: Machine policy value 'DisableRollback' is 0
Action ended 8:06:41: InstallFinalize. Return value 3.
MSI (s) (5C:C8) [08:06:41:078]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=896876757,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: DialogInfo(Type=1,Argument=MSXML 4.0 SP2 (KB927978))
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegisterBackupFile(File=C:\Config.Msi\7296db.rbf)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0\CLSID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: ProductInfo(ProductKey={37477865-A3F1-4772-AD43-AAFC6BCFF99F},ProductName=MSXML 4.0 SP2 (KB927978),PackageName=msxml.msi,Language=1033,Version=68429425,Assignment=1,ObsoleteArg=0,,,PackageCode={2B27DCD9-53FA-4885-B6CD-698623819F4C},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegRemoveValue(,Value={F5078F18-C551-11D3-89B9-0000F81FE221},)
MSI (s) (5C:C8) [08:06:41:078]: Executing op: RegAddValue(,Value={f5078f18-c551-11d3-89b9-0000f81fe221},)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\Version,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegRemoveValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegAddValue(,Value=4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegRemoveValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:093]: Executing op: RegAddValue(,Value=Msxml2.DOMDocument.4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegOpenKey(,Key=Msxml2.DOMDocument.4.0,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegRemoveValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32,,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:109]: Executing op: RegRemoveValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:125]: Executing op: RegAddValue(Name=ThreadingModel,Value=Both,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegRemoveValue(,Value=C:\WINDOWS\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegAddValue(,Value=#%%SystemRoot%\system32\msxml4.dll,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegOpenKey(,Key=CLSID\{88D969C0-F192-11D4-A65F-0040963251E5},,BinaryType=0)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegRemoveValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: RegAddValue(,Value=XML DOM Document 4.0,)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\winsxs\Manifests\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: SetTargetFolder(Folder=C:\WINDOWS\system32\)
MSI (s) (5C:C8) [08:06:41:140]: Executing op: FileCopy(SourceName=C:\Config.Msi\7296db.rbf,,DestName=C:\WINDOWS\system32\msxml4.dll,Attributes=32800,FileSize=1230336,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
MSI (s) (5C:C8) [08:06:41:140]: File: C:\WINDOWS\system32\msxml4.dll; Overwrite; Won't patch; REINSTALLMODE specifies all files to be overwritten
MSI (s) (5C:C8) [08:06:41:156]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])
MSI (s) (5C:C8) [08:06:41:156]: Executing op: FolderRemove(Folder=C:\Program Files\MSXML 4.0\,Foreign=0)
MSI (s) (5C:C8) [08:06:41:171]: Executing op: ActionStart(Name=RemoveODBC,Description=Removing ODBC components,)
Property(S): WinSxsPolicies.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Policies\
Property(S): policydir.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\
Property(S): WindowsFolder.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\
Property(S): SystemFolder.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\system32\
Property(S): WinSxsManifests.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\Manifests\
Property(S): payload.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_ff05e224\
Property(S): policydir_ul.0E9F98FC_A692_A6DF_FF6B_D6B9ABF34537 = C:\WINDOWS\winsxs\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_ff05e224\
Property(S): DesktopFolder.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Desktop\
Property(S): ProgramMenuFolder.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Start Menu\Programs\
Property(S): MenuMSXML.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Documents and Settings\All Users\Start Menu\Programs\MSXML 4.0\
Property(S): DOC.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\doc\
Property(S): LIB.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\lib\
Property(S): INC.4576A2F1_959E_4BCA_94A9_596523761901 = C:\Program Files\MSXML 4.0\inc\
Property(S): CommonFilesFolder = C:\Program Files\Common Files\
Property(S): MicrosoftShared.3FB7DAB3_19E7_40A0_8730_4482CE77AC59 = C:\Program Files\Common
Property(S): SOURCEDIR = d:\0bf1cf5dc08b21e680bffdcd\
Property(S): SourcedirProduct = {37477865-A3F1-4772-AD43-AAFC6BCFF99F}
Property(S): ProductToBeRegistered = 1
MSI (s) (5C:C8) [08:06:41:312]: Note: 1: 1708
MSI (s) (5C:C8) [08:06:41:312]: Product: MSXML 4.0 SP2 (KB927978) – Installation failed.
MSI (s) (5C:C8) [08:06:41:312]: Cleaning up uninstalled install packages, if any exist
MSI (s) (5C:C8) [08:06:41:312]: MainEngineThread is returning 1603
MSI (s) (5C:20) [08:06:41:421]: Destroying RemoteAPI object.
MSI (s) (5C:B0) [08:06:41:437]: Custom Action Manager thread ending.
=== Logging stopped: 11/21/2006 8:06:41 ===
MSI © (EC:58) [08:06:41:437]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI © (EC:58) [08:06:41:437]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/21/2006 8:06:41 ===
Thanks everyone!!