Win98- help -to Prevent deletion of system Files

[Und3ertak3r]

Hi Guy's,
to miss the boring tale.. scroll to the bottom (you may miss some fact that may help)
My problem is with a friends Compaq desktop, Celeron 466 and win98..

The problem started with a "missing or corrupted Himem.sys" error along with failed PSU.
New PSU and a reload of '98 and back in action for a week or so.. and its back on my bench with the Himem.sys error.. I was in a rush , Recovered some of his data, tried to find a cause, virii scanns scanndisk, system checks .. reload '98 run the machine for a few hours OK.
has it home 1hr and " himem.sys missing or corrupted" error.. crap.. did a check in DOS and found a number of Windoze files missing.. did a warm install to sus out what was happening. And just by accident I checked the recycle bin .. BINGO here are 113 files from the c:\Windows folder as well as some of the folders??? hmm not a virus (I know his sons want a new puter but dad not ready)..I had suspected a hardware problem.. but hardware won't place many files from one system folder in the recycle bin, and a virus won't be so kind as to drop the files in the bin..
My option here was to do a full restore after a repartition and formatt, and reload '98. what can I do,? tell him I suspect what the boys are up to.. oh and I will see how smart they are.. I reset the attributes of all the windows files (those I could easily) to hide all of them, then I selected all of the JPG's and WAV files and changed the attributes to SYSTEM..
After 2 days bench running my friend collected.. and bugger me... "it lasted 5 mins" was the reply.. (Note he is not computer savvy, the boys do the connecting and any "software changes" required. and he will hide in the corner..

I suspect the boys are trying to convince their dad that this machine is Fuxored by deleting the windows files. They seem to know what they are doing, I tried to see what would happen by just selecting all files and deleting, nah each time a GPF and system off.. It must be a script to target many files but not all.. but it isn't good enough to delete the files correctly (I won't say completly).

Ok Where to from here? This is where I need advice..

1. do I, play their game and say that the machine is Fuxored.. and hope I pick up a toy to run slackware or RH8..
2. Load Win 2k or XP and tighten the security ..
3. Find some proggie (searching) to prevent user or script deletion of the system files ...
4. Load a key logger.. and hope the log file is readable after the system files are "deleted"..
5. Belt the little begger's over the head with a crowbar (geez I love Half Life)
6. Setup policies or a registry setting to disable some user actions...
7. Or find some prank to let them know I'm on to them
8. Or I am a fool it is really a hardware problem

Your thoughts please.. and sry for the diatribe..

Cheers

Proggies found so far..

The Lock 2002 (beta) http://www.crashcoursesoftware.com/d...k2002beta.html

[zigzag_8336]

2, 4, and 5 especially

[tyger_claw]

There is no chance that this is a hardware failure. Files do not find themselves in the recycling bin from a glitch in hardware. The files would either become corrupt, mistaken or removed without trace. Finding the files in the recycling bin means someone placed them there (& not something)

Personally speaking,

Play the game and slap on win2k with ultra tight security.
Create login's for all the user's and remove all file access to the hardrive.
Also monitor their activities with a logger of sorts.
(Get the father's permission by telling him it's to see what the computer does , consent is consent!)

This would be a good little project for you to work some security skills and see if you can secure this little box from these little *****s.

[Und3ertak3r]

Thanks zz and tc,

Your comments are appreciated.. Ideas are good..

Cheers

[bballad]

There is no unatteneded act that would put files in the recyile bin the kids are doing this...unles they have ha BO or sub7 put on the system.

I say screw the kids load win nt 4 so it can't run any games Then build user acounts and lock them down

I would think changeing the attrib of the files to system would do the trick is the dad actualy letting them re attrib the files while he watches...is he then surprised by every thing gettign deleted?

one word LART

[tyger_claw]

Undertaker,

You can also keep win98 on and use a program to lock the computer from unauthorized acts.

NetworkPunk.com has a program called PunkLock that you can use. There isl also a program called PCArmor (I think). Basically look for a program that retailers and pc shows use for display computers... that could work?

[tyger_claw]

Undertaker,

You can also look into this program: DeepFreeze

It seems to do what you're looking for....

[Lebb]

2,4 or 5

But then Win 98 crashedd first time

[SirDice]

Just 1 note/question. Does a keylogger record mouse movement/clicks? If that's not the case, would a keylogger tell you someone just selected the files and right-clicked to select delete?

I would do 2, 5 and 6. As bballad said use a LART for option 5

[Und3ertak3r]

Some keyloggers will log "Mouse Clicks", even capture screenshots, email the captured information to one or more addy's..

BTW: I ran out of time was going to load Win2k and lock it tighter than a drum... instead .. Installed the Windows files into another folder and copied them across to a folder called "Windows".. Told my friend infront of the boy's that I have loaded a Logging prog to track the fault in the system.. the system has lasted 24hrs now..hmmmmm

Guy's thanks very much for you information, TC the programm names and the links are very handy.. I just hope that this thread is of help to more than just myself..

Cheers and thanks again