If you have 'untouched' machines other than the one you're working on, you might want to shut them off until you can have proper forensic images taken of them and have those images archived with proper chain of custody established. This could all be a bizarre goof, but it could also be something malicious.
-----Original Message----- From: David W. McSpadden [mailto:[email protected]] Sent: Wednesday, September 02, 2009 9:57 AM To: NT System Admin Issues Subject: Re: User Profile missing after windows updates Why would you suspect malware because the profile is missing? ----- Original Message ----- From: "Steven M. Caesare" <[email protected]> To: "NT System Admin Issues" <[email protected]> Sent: Wednesday, September 02, 2009 9:53 AM Subject: RE: User Profile missing after windows updates If WSUS is in use, and therefore these machines are disabled from going to WU directly, I'd suggest running MalwareBytes or some such on them ASAP. -sc > -----Original Message----- > From: David W. McSpadden [mailto:[email protected]] > Sent: Wednesday, September 02, 2009 9:41 AM > To: NT System Admin Issues > Subject: Re: User Profile missing after windows updates > > 10 to 12. The one I am working with is in the next room. Everyone > else is > in standby mode while I figure it out. > ----- Original Message ----- > From: "Steven M. Caesare" <[email protected]> > To: "NT System Admin Issues" <[email protected]> > Sent: Wednesday, September 02, 2009 9:37 AM > Subject: RE: User Profile missing after windows updates > > > You original report was plural. This last post indicates it's a single > machine? > > Is this a widespread issue, or is this one user affected? > > -sc > > > -----Original Message----- > > From: David W. McSpadden [mailto:[email protected]] > > Sent: Wednesday, September 02, 2009 9:32 AM > > To: NT System Admin Issues > > Subject: Re: User Profile missing after windows updates > > > > IE8 is disabled for us. I haven't gotten through the WSUS logs yet > so > > I am > > unsure of what updated her machine. > > Local Profiles. > > ----- Original Message ----- > > From: "James Rankin" <[email protected]> > > To: "NT System Admin Issues" <[email protected]> > > Sent: Wednesday, September 02, 2009 9:28 AM > > Subject: Re: User Profile missing after windows updates > > > > > > I am assuming these are local profiles...are the folders actually > > gone? If they were roaming, you'd be restoring a backup right now I > > guess. Have any updates been done overnight (it wasn't the IE8 > upgrade > > going out, was it?) > > > > 2009/9/2 David W. McSpadden <[email protected]>: > > > XP Pro SP3. > > > Users coming in this morning are missing their profiles. That means > > there > > > Outlook Express email, their IE favorites, desktop > > shortcuts....etc.... > > > What can I do to save my sanity? > > > System Restore is disabled on the majority of these machines so the > > > Virusscanner can delete files without them going into a restore > bin. > > > > > > Any help is appreciated. > > > For the Lurkers that don't like of topic here is one you can take a > > swing > > > at. > > > Let us know what you know. > > > Thanks > > > David > > > > > > > > > > > > > > > > > > > > -- > > "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put > > into the machine wrong figures, will the right answers come out?' I > am > > not able rightly to apprehend the kind of confusion of ideas that > > could provoke such a question." > > > > http://raythestray.blogspot.com > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > > > > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
