Files disappearing from root folder!

[Jasen]

I think my windows box is trying to commit suicide.
Every once in a while I'll open up my c: drive and there will be NO files left. All the folders are there, but ntdetect.com, ntldr, boot.ini, etc.. are all gone. Luckily, I can just connect to my server's drive real quick and copy them back if I have to reboot, but I need to find out why. Luckily this is my personal box and not a production machine.
What I have verified: disabled network access from any account, disabled any anonymous connections (even though this machine is behind a firewall anyway), all unneeded services are disabled, running the latest definitions in Norton Corp AV, set all the affected files permissions to read only from all users, including administrators and turned on auditing. They still disappear after a few days. The auditing report says nothing.
I'm baffled. I currently keep a copy of the files a folder and just copy them back if I notice them gone. But this is way strange.. I have never heard of anything like this before. ________
Remember, you're unique... just like everyone else.

 

[gwcann]

Download a copy of SiSoft's Sandra and run the hardware check. (32bit app, pretty good for a freebie) My gut says hardware drive or drive controller.

Did you try all the obvious routes?
Service Pack, IE Service Pack, etc?
Is this a domain? Are there group policies in effect?
Is the machine recently loaded?
"Anything" happen pryor to this weirdness?
Even though you can turn off the C$ and it recreates on reboot did you remove it via the regestry?
Have you pissed off anybody lately, are they gettign even?
Anybody have direct access to your box?

 

[Jasen]

haha... in answer, this is my personal box at home. No domain, only my little home LAN. It's behind a firewall, there is no access to it from the outside. I live alone.
The C$ share should be irrelevant, since I've denied network access from all accounts. At least I know *I* can't login as myself or the administrator account from my other w2k boxes, or my FreeBSD and linux boxen. My firewall is set to only allow port 80 and 21 through, and they are mapped to ONLY go to the FreeBSD webserver. If anyone wants to test this, go ahead. 66.176.69.196
BTW, I'm running SP3, IE6 and am up-to-date with my "critical" updates so far as I know. I've disabled a lot of services.. but I doubt that could cause something like this either. I have no trojans according to my AV software. My first thought was somebody has a backdoor and is screwing with me. But it sure doesn't look like it. I've enabled logon auditing and no one but myself is accessing anything, and that being only locally.
I'm stumped. I have never seen this before ever. But I'm loath to reinstall. ________
Remember, you're unique... just like everyone else.

 

[wolluf]

Have you run chkdsk?

 

[tazuk]

This sounds similar to my problem a while ago - after installing SP3 I started getting BSoD's on boot referring to missing files. Once I'd reversed the SP3 install through safe mode the problem did not re-occur. I tried installing SP3 a second time and the same situation occured. As a result I'm avoiding SP3 at the moment, but have yet to clearly establish the root cause of the problem.
Can you recall whether the situation occured before SP3 install? If not, IMHO i'd suggest removing SP3 and monitoring the situation..
BTW if anyone can resolve this I'd be most grateful..