[JGZinv]

I've got sort of a weird bug happening with a friend's computer and need some
kind of tracker to figure out more of what is going on.

It's a old P4 Win XP machine, been abused software wise in terms of packing it chock full
of unneeded programs. I've had "that" conversation with him...

He likes to leave it either logged off or at the screen saver, and sometime during
that the machine likes to randomly delete the sndvol32.exe and mmfdriver.inf (going from
memory there)... so his sound doesn't work until they are restored.

Done the usual updates, viral scans, etc... nothing.

So what I'm looking for is some sort of file tracker that'll run in the background, logs what is
accessing / deleting the file and preferably with a time stamp.

Any ideas?

[FUBAR-BDHR]

Did you check the startup folder, scheduled events, and run and run once in the registry?  Hijackthis also might help find the cause. 

[JGZinv]

Startup has nothing unusual, didn't check scheduled events. Typically try to stay out of the registry.
HijackThis I've not used for myself, but suppose I should have looked into it by now.

[redsniper]

Backup all the irreplaceable data and reformat. If it's really that bad, you'll both be better off starting fresh.

[FUBAR-BDHR]

What?  He has 2 files being deleted.  A reformat for that?  It could be as simple as an uninstaller from a driver update running at login and not removing itself.  Worth investigation before pulling the plug. 

[Rodo]

Not really, unless you are running a 90's pc (drivers...drivers...), you should consider starting from 0 when stuff like that start to happen.
Back up what you need now and save yourself future nightmares.

[FUBAR-BDHR]

I've never reloaded one of mine except for hardware failure where I couldn't just drop a ghost image onto it due to the hardware being too different.

[redsniper]

What?  He has 2 files being deleted.  A reformat for that?

It wasn't the two files being deleted that made me suggest a reformat, but rather the

been abused software wise in terms of packing it chock fullof unneeded programs

[JGZinv]

In general I would agree with the wipe, however as I have had that discussion
with the owner several times... he still attempts to squeeze every last drop of
life out of the already dead horse.

New info:

Got a chance to check said system out again tonight, it is running NTFS on XP home.
However, checking the system32 folder led me to find the files I replaced are still there,
even though the audio does not work.

The only difference then, would appear to be when I replaced the two audio files before (and the sound worked for a period
of time), I also installed the audio drivers again for kicks. So my line of thought is shifting to that as
a possible lead.


The original question about a file logger still stands though, as that would have various uses
for diagnostics.