It's been busy here at chez chewie...
The black one is done and the sliver one just needs stability testing but the diddy little beige one has surprised me...
Got a phone call on Thursday about it. Seems there was an ambiguous system notification telling the owner that there had been a serious problem and the system needed rebooting.
Once rebooted they found shortcuts and personal files missing.
A thorough browse of the XP Pro installation reveals that nothing is really missing, but the user folder has been changed.
The files all appear to be where youd expect them..
...but the system is using something else...
C:\Documents and Settings\<user>\
Obviously the short solution would be to either set the user's directory to what it should be or create a new user and move everything over, but I want to find out what caused this to happen.
C:\Documents and Settings\TEMP\
The system is protected by KAV v5 & Outpost v3, the owner has installed Super Antispyware (an honest program) and I can't see anything unusual in the HJT output (apart from a logon notification to Super Antispyware) so I don't think it's a malicious process. I think Windows had a fit.