Thanks for the reply, but the link doesn't actually discuss my problem.
I used wimpwall as an example. I really think that my whole windows
filesystem is reverting, as my start menu sort order is also reverting,
and I've just found out that even my printer list and mouse button
configuration is reverting to the previous version.
Consider the following possibilities...
1) Bad shutdowns
The registry is written to HD hive files during the shutdown process,
so anything that cuts this process short may cause registry changes
made during the session to not "stick".
Usually, you'd expect this to come to your attention, even if only
because the next startup will check the file system (flagged as
"dirty" because the bad exit interrupted file operations).
There's a scenario that may be historical (i.e. predating XP) where
hard drives would accept data and signal to the controller that the
transfer was complete, before actually writing this data from the hard
drive's own cache RAM to the platters. When the motherboard switched
off ATX power, this also killed the HD and lost the contents before
they ever made it to the platters.
2) Registry fallback
If the registry is "bad", the system may use a backup copy. However,
I don't think this applies to XP, where there's no true registry
backup; only one set of keys is kept as "last-good", and AFAIK this is
stored within the same file - so anything that eats a registry file
will leave the registry trashed.
3) System Restore auto-fallback
I mention this as something that this pattern suggests may be
happening, but to my knowledge, System Restore has *never* acted in
this way, in WinME or in XP.
4) NTFS rollback
Much is made of NTFS's transaction rollback feature, which maintains
the sanity of the file system by rolling back any changes that are
interrupted. The small print points out that only metadata is rolled
back in this way; user data (i.e. the data that's actually *in* the
file) is not protected at all.
As it is, XP will invoke AutoChk if the file system is flagged as
"ditry" when the OS starts up. This will automatically "fix" any file
system errors without telling you what it is doing while it is doing
it, or stopping to ask you for permission to do so. The problem is
that these "fixes" will always discard data, if forced to choose
between the sanity of the file system and data preservation.
5) Bad sector defect management
The hard drive itself will attempt to "fix" bad sectors (i.e. where an
attempt is made to access disk, and this fails or needs "too many"
retries). When this is a new write to disk, it's OK; the original
destination is marked out of the HD's address space, a new sector is
written to instead, and that sector is addressed as if it were the
original one. But when a read fails, the contents of the bad sector
are lost, and may be left "empty".
In addition to the hard drive's attempts to "fix" bad sectors, NTFS
will do the same thing; any access failures that percolate up to NTFS
code's attention will prompt the same sort of response from that code.
6) Permissions issues and other securityware
Normally you'd expect non-permitted changes to be refused, rather than
applied and then lost when Windows starts again, but some security
approaches may do this, by restoring a known state on boot, losing any
changes you made in the process. Some roaming profiles and domain
management strategies may do this, as may some 3rd-party addons.
I'd take this quite seriously, as a form of data loss or loss of
control over the system. I'd start by checking the hardware
reliability, especially that of the hard drive (I'd use HD Tune from
www.hdtune.com) and then I'd want to exclude malware, and check out
user account rights and related administration.
------------ ----- --- -- - - - -
Drugs are usually safe. Inject? (Y/n)
