[ale] Help unraveling a "practical joke"?

[Michael Trausch]

OT as it might be, look for what ms calls "folder redirection".
On Nov 2, 2010 4:59 PM, "Greg Freemyer" <greg.freemyer at gmail.com> wrote:
> All,
>
> I've got a situation where two business partners were having issues
> with each other.
>
> Based on a brief look at the image of one of their computers:
>
> When partner-A came in to work yesterday and logged into his computer
> with his normal login, a new user profile "/documents and
> settings/TEMP" was created with basically nothing in it.
>
> I still see "/documents and settings/UserA" but when I login as UserA,
> I am presented the desktop from .../TEMP/Desktop.
>
> It feels like a practical joke to me, but I don't know how to make it
> happen in the first place, and I don't know how to undo it so that
> UserA sees the Desktop for "/documents and settings/UserA/desktop".
>
> Alternatively, it might have been some malware screwing with things.
>
> At this point, I don't think its worth spending a lot of time on, but
> I would like to undo the damage.
>
> Thanks
> Greg
> --
> Greg Freemyer
> Head of EDD Tape Extraction and Processing team
> Litigation Triage Solutions Specialist
> http://www.linkedin.com/in/gregfreemyer
> CNN/TruTV Aired Forensic Imaging Demo -
>
http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/
>
> The Norcross Group
> The Intersection of Evidence & Technology
> http://www.norcrossgroup.com
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.ale.org/pipermail/ale/attachments/20101102/0e96f790/attachment.html