1

I have a couple of Windows boxes (Windows XP and Windows Server 2008) where a few EXE files (unwise.exe - from Wise installation system - among others) simply disappear from time to time.

I tried to narrow down this issue by disabling antivirus, anti spyware, etc. (I started by looking at their log files and quarantine), but with no luck. There weren't any clues in the event viewer either.

Any suggestion?

1

3 Answers 3

3

This sounds like a perfect job for Windows Sysinternals Process Monitor. This powerful tool allows you to monitor almost every activity on your system.

While it is powerful it can be also dangerous because when not using proper filters and logging methods it can have a considerable impact on your system (Virtual Memory exhaustion to name one).

In your case I'd do the following:

  • download Process Monitor, extract and run it as administrator
  • stop the initial capture by pressing Ctrl+E
  • change the backing file from Virtual Memory to a disk file to lower the possible strain on your system's RAM/Pagefile: File -> Backing Files... -> Use file named (a separate disk/partition is best for this)
  • apply appropriate filters to your situation: Filter -> Filter... select Event Class is File System then Include and press Add
  • to narrow the output even further you can specify paths to files you want to monitor: select Path is <path> then Include and press Add and OK
  • to eliminate all unnecessary events from the capture select Filter -> Drop Filtered Events
  • start capturing by pressing Ctrl+E

This should give you some hints about what exactly is happening to your files while having low impact on your system.

4
  • thank you very much for the detailed instruction. I'll give it a try
    – Stefano
    Dec 14, 2012 at 18:48
  • 1
    I can't comment on @longneck's answer because of my low rep but procmon has command line parameters so you can make a startup script that will launch it. This requires you to export the desired configuration from the File menu. You should also specify an unique backing file name (current date in my example), because procmon overwrites the backing file. For example: procmon /BackingFile d:\logs\%DATE%.pml /LoadConfig d:\logs\config.pmc /Quiet. When procmon exits you can read the backing file like an off-line log.
    – mprill
    Dec 14, 2012 at 20:24
  • I was finally able to run procmon at windows startup, but the logfiles it produces are corrupted upon system restart. Is there a way to gracefully stop procmon?
    – Stefano
    May 21, 2013 at 8:49
  • Corrupted in what sense? You can stop all instances of procmon with procmon /Terminate.
    – mprill
    May 25, 2013 at 7:27
4

You could run Process Monitor continuously, but with a filter of:

  • Operation: SetDispositionInformationFile
  • Result: SUCCESS
  • Detail: Delete: True

This will accumulate a log of all deleted files. Next time you notice a file gone missing, pull up Process Monitor and see what process was responsible for deleting the file.

1
  • I'll try this, thanks. Is there any way to have Process Monitor survive a windows restart (i.e. to have it automatically restart monitoring on Windows startup)? tia
    – Stefano
    Dec 14, 2012 at 18:47
3

Turn on File Auditing for the relevant folders. The next time they're deleted, the Event Viewer will have information on who/what deleted them.

You might want to turn it on only for Delete events - otherwise your Event Viewer will be rapidly overrun by standard events (like file access, etc.).

2
  • thanks! I gave it a try but I need to study a bit more :) Infact I was able to turn on file auditing, but when I deleted a file (I did not want to wait ...) I see in the event log that "an object was deleted", without any info about who deleted the object - but probably I miss something in the configuration
    – Stefano
    Dec 14, 2012 at 18:43
  • While auditing does work, I'd say it requires considerably more setup than using Process Monitor. They give similar information. It depends on the circumstances but in some instances the setup steps for auditing (including the need to enable in group policy, specify audit options for the folder/file in question, etc.) are just more difficult to accomplish.; Feb 24, 2023 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .