Win xp Pro Help

[Jarrod]

Hi I have installed Winxp pro sp2 on a client’s pc. I do maintain some software on this client’s pc. When I installed winxp and the software, everything worked fine, then 2 days after some files on my program disappears and the program needs to be reinstalled. The client swears blind that they did not do anything wrong on the pc.
The reason I upgraded the pc from win98 to winxppro is because of the same problem - one day everything is fine next day some files are missing again.
I was thinking of an events logger that will log when ever a file is deleted or moved. Does anyone know if there is a events logger on winxp pro sp2 that will log deleting of files or if there is a program like this one what i can download.
This machine does not connect to the internet so it cant be any hacking etc.
Its a case of the mysterious file eating monster

Thanks in advance

 

[bekdik]

Remove the user from the administrators group and make them a basic user.

 

[Ekhaatvensters]

^ Probably a good idea.

Sounds like a virus almost? But one that caries over onto a new OS??

Good luck man, this is almost as bad as when I had a problem/virus where my temp internet files folder would swell up to some huge size and take up all the space on my harddrive. i had 4kb free at one point in time, i had to dlete files just to keep my PC running. That sucked...

 

[Skeptik]

Sounds like a virus.

 

[noswal]

Control panel > Administrative tools > event viewer - has various logs

 

[BTTB]

I mate who sells PC's got to know one of his clients tricks so well that he made the guy stand in front of witnesses and watch that XP works perfectly on his PC before he took delivery.

He did this as he knew that this guys kids/family would mess the PC up in no time.
Lo and behold the very next day he phoned to tell my mate the PC was broken.
This time my mate told him to take a hike. He doesn't get paid for fixing XP.
I can very well understand as it doesn't take 2 minutes to set-up XP with all the necessary drivers and software.

I think in future he should do something about the user grouping and limit the privileges as well like bekdik suggested?
And make a image of the working partition.

 

[SlickNick]

Make sure that these people can't see their dll's by hiding the files, and also make sure that they aren't able to see their file extensions.

 

[graviti]

I had a similar issue a while back with a laptop, that was locked down so tightly it was ridiculous, and yet files were still disappearing. It turned out to be a faulty hard drive.

If you've upgraded to XP on the same HDD, and you're having issues, get them a small HDD, and reinstall on there. Let it run for a few days. If no issues, you've found the issue. If not, then we'll have to assume a user problem. I tend to have 2 or 3 spare HDD's lying around for exactly this reason. Usually diff circumstance though, as clients state that their HDD is faulty, and I bring in a brand new one to prove it is them, not HDD, but in this case it may actually be the HDD.

What you got to lose?

 

[Jarrod]

Hiya thanks for the replies.

I dont think its a virus cos it was a clean install (format the works) I dont think its a hard drive error as its still relatively new. I suspect that its user error but i cannot prove it.

All that i loose is about 150kms (there and back) and my time
Thanks for the advice guys much apreciated

 

[graviti]

I'd still say a problem with HDD is a problem. What environment is it in. High magnetic environment can cause that. Or even just a bad drive. it happens. A tool I use for this scenario is a new product from Altiris. They call it Software Virtualization. Install the software inside this package, and it create's a "Layer" to lay down on Windows. You can then reset the software back to original status with the click of a button, and it literally takes a second or two. Doesn't work perfectly with drivers, but works well with normal Win32 software packages. In this case, you can install the package, and if they find stuff disappears, they merely reset the program. Hopefully they don't find a way to break that as well. Merely put, on a locked down PC, with Windows NTFS partitioning, and the user is a standard user, this package is great. It's called Altiris Software Virtualization.