Thanks for your input. It happened again to him this morning. As was mentioned I do not believe it is pebkac because no matter how high up the admin chain you go you still can't delete the contents of the windows folder while it is running (so far I haven't not seen a way)... I have tried. Even so he is a normal domain user meaning he has no admin rights.

Hardware issues I ruled out because it happens on his virtualbox, normal desktop (tried two different models) and his laptop. We used three different OS versions with different sp's (about 12 different cd's/dvd's thinking that the install was bad. It happens in XP, Vista, and Win 7 with no prompting and most times he isn't at his desk when it occurs (here was in the field yesterday afternoon and this morning his machine was all hosed again).

Enlighten me on the new Window's Feature... is it similar to the meat virus?

In the meantime I'll mimic his environment on a honey pot and see what happens... if I find out I'll let you all know