Chewie
01-06-2007, 04:12 PM
It's been busy here at chez chewie...
http://img231.imageshack.us/img231/7484/2downca3.th.jpg (http://img231.imageshack.us/my.php?image=2downca3.jpg)
The black one is done and the sliver one just needs stability testing but the diddy little beige one has surprised me...
Got a phone call on Thursday about it. Seems there was an ambiguous system notification telling the owner that there had been a serious problem and the system needed rebooting.
Once rebooted they found shortcuts and personal files missing.
A thorough browse of the XP Pro installation reveals that nothing is really missing, but the user folder has been changed.
The files all appear to be where youd expect them..
C:\Documents and Settings\<user>\
...but the system is using something else...
C:\Documents and Settings\TEMP\
Obviously the short solution would be to either set the user's directory to what it should be or create a new user and move everything over, but I want to find out what caused this to happen.
The system is protected by KAV v5 & Outpost v3, the owner has installed Super Antispyware (an honest program) and I can't see anything unusual in the HJT output (apart from a logon notification to Super Antispyware) so I don't think it's a malicious process. I think Windows had a fit.
Any ideas?
http://img231.imageshack.us/img231/7484/2downca3.th.jpg (http://img231.imageshack.us/my.php?image=2downca3.jpg)
The black one is done and the sliver one just needs stability testing but the diddy little beige one has surprised me...
Got a phone call on Thursday about it. Seems there was an ambiguous system notification telling the owner that there had been a serious problem and the system needed rebooting.
Once rebooted they found shortcuts and personal files missing.
A thorough browse of the XP Pro installation reveals that nothing is really missing, but the user folder has been changed.
The files all appear to be where youd expect them..
C:\Documents and Settings\<user>\
...but the system is using something else...
C:\Documents and Settings\TEMP\
Obviously the short solution would be to either set the user's directory to what it should be or create a new user and move everything over, but I want to find out what caused this to happen.
The system is protected by KAV v5 & Outpost v3, the owner has installed Super Antispyware (an honest program) and I can't see anything unusual in the HJT output (apart from a logon notification to Super Antispyware) so I don't think it's a malicious process. I think Windows had a fit.
Any ideas?