Which Files Installed by Client Component Under TCP/IP Properties?

If you unselect the "Client for Microsoft Networks" component under TCP/IP
Properties in Windows 2000, then uninstall that component, reboot, and
re-install it, what files are being physically copied into system32 and
other directories?

We have a virus on a few machines that attempts to connect out to the
Internet on port 139. I was able to clear it at least temporarily by
uinstalling and re-installing the Client component. I would like to
isolate out which files were altered from the original distribution.

Does Windows maintain checksums somewhere of checksums of the files it
thinks should be installled?

--
Will

Hi!

You could use sigverif (File Signature Verification) tool to find out wheter
or not system files have been replaced.

HTH

Toni


"Will" <westes-(E-Mail Removed)> wrote in message
news:ztmdnREFQ8YkdqzYnZ2dnUVZ_t-(E-Mail Removed)...
> If you unselect the "Client for Microsoft Networks" component under TCP/IP
> Properties in Windows 2000, then uninstall that component, reboot, and
> re-install it, what files are being physically copied into system32 and
> other directories?
>
> We have a virus on a few machines that attempts to connect out to the
> Internet on port 139. I was able to clear it at least temporarily by
> uinstalling and re-installing the Client component. I would like to
> isolate out which files were altered from the original distribution.
>
> Does Windows maintain checksums somewhere of checksums of the files it
> thinks should be installled?
>
> --
> Will
>
>

"T. Uranjek" <(E-Mail Removed)> wrote in message
news:O3#(E-Mail Removed)...
> Hi!
>
> You could use sigverif (File Signature Verification) tool to find out
wheter
> or not system files have been replaced.

I appreciate the pointer on that.

--
Will