XP Files Have Changed

[Charlie W]

I have AVG 7.5 Free Edition Virus Scanner & have 4 files that have been changed for some reason ,They are the following :

"C:\WINDOWS\system32\kernel32.dll","Change","Changed"
"C:\WINDOWS\system32\user32.dll","Change","Changed"
"C:\WINDOWS\system32\shell32.dll","Change","Changed"
"C:\WINDOWS\system32\ntoskrnl.exe","Change","Changed"

This is the results of my last scan & the computer has been like this for a couple of months & I do not know why or what would of changed them . Below are the results of my last scan today . I did restore system to an earlier date when I first found out they were changed because in Outlook Express , I would have to close the program & go back in to read another email after about 5 minutes . Outlook has been working lately without having to restart the program

"General properties",""
"Report name","Complete Test"
"Start time","1/13/2008 2:12:52 PM"
"End time","1/13/2008 2:48:50 PM (total: 35:56.6 Min)"
"Launch method","Scanning launched manually"
"Scanning result","No threats found"
"Report status","Scanning completed successfully"
" ",""
"Object summary",""
"Scanned","96969"
"Threats Found","0"
"Cleaned","0"
"Moved to vault","0"
"Deleted","0"
"Errors","0"
"C:\WINDOWS\system32\kernel32.dll","Change","Changed"
"C:\WINDOWS\system32\user32.dll","Change","Changed"
"C:\WINDOWS\system32\shell32.dll","Change","Changed"
"C:\WINDOWS\system32\ntoskrnl.exe","Change","Changed"

I have spywareBlaster , Spybot Search & destroy , AVG Anti-spyware , Windows Malicious software Removal Tool , Lavasoft Ad-Aware SE Personal & CCleaner .

I have a program that came with my cd/dvd burner called Cyberlink Power DVD & there was a free program with it Cyberlink Power2GO that kept popping up wanting me to upgrade to a pay version . It finally stopped popping up . I also have Nero that came with the burner. I also downloaded a program called Tracking the Eye , for hurricane following & some military manuals . It seemes as though it was after the power2go stopped popping up , is when I first found the files had been changed .

I am running XP Pro SP2 with all updates . Below is my system signature :
Abit SG-80, Pentium 4 , 541 Prescott 3.20 GHz , 800MHz FSB, Hyper-Threading , CPU. 2 GB Ultra PC3200 DDR 400MHz Memory. Seagate Barracuda 160 GB & 400 GB SATA Hard Drives. ATI AIW X800 XT 256 MB Video Card.LITEON 16X SuperALLwrite DL DVD/CD Burner , Sony 3.5 Floppy. Ultra Grid Case, 2 X 120 MM Intake & Exhaust fans, 500 Watt Ultra V series PSU.Windows XP Pro SP2 Version 2002 OEM

I do remember now why I had to restore system to an earlier date is because I lost all my bookmarks & some ad-ons & email . I am using FireFox as my browser , which is updated now to version 2.0.0.11 and IE 7. I use FireFox 99.9% of the time though . I do not remember what version firefox I had when I lost the above .

My question is how do I restore or recover the files that have been changed . Windows has all updates in the last few months & I'd like to be able to get these changed files back without having to start from scratch .

Thanks much for feedback .

[Kov-Ice]

If your only concern is about the four files shown as "Changed," then you have no worries. I found this on the AVG forums:

It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected. To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in C:\ and AVG will rebuild it the next time it is run.

HTH

[Petef56]

Originally Posted by Charlie W I have AVG 7.5 Free Edition Virus Scanner & have 4 files that have been changed for some reason ,They are the following : "C:\WINDOWS\system32\kernel32.dll","Change","Changed" "C:\WINDOWS\system32\user32.dll","Change","Changed" "C:\WINDOWS\system32\shell32.dll","Change","Changed" "C:\WINDOWS\system32\ntoskrnl.exe","Change","Changed"

The files listed aboove typically change after certain Windows Updates are installed.

You can reset AVG per post #3 at link below..
http://forum.pcmech.com/showthread.php?p=1304051#3

---pete---

[Charlie W]

Thanks much for the info . I thought I might of got infected by something . Thanks again .