Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows Server 2008 machine where we publish our web site. Recently, we noticed odd problems with the site after publishing, and traced it down to the \bin directory of the website being empty. It appears that any time a binary file (.dll/.exe) is remotely copied to that machine, the file is deleted shortly afterwards.

This is happening anytime files are copied through the domain path to the box (eg \machinename\inetpub\wwwroot\website). Using Remote Desktop access to the box and then copying files while logged into the machine works fine.

I've use Process Monitor, Process Explorer, and browsed both the event logs and the virus scanner logs extensively, and can find no evidence of these deletions. I have no idea why this happening or what might even be the cause. Does anyone have experience with this or some idea of what I might do to track this issue down?

share|improve this question
Sounds like AV to me. I hate AV... – Ryan Ries Jan 4 '13 at 17:06
It feels strongly like the AV is the cause, but I can't verify that it's actually doing anything to the files. No logging, no quarantines, no suspicious process activity. – CodexArcanum Jan 4 '13 at 17:19
I'm having the same exact symptoms. Did you ever find a solution? – Charlie Jan 15 '13 at 20:26
Are you sure you used Process Monitor correctly? If a file is moved to the recycle bin, the Operation is SetRenameInformationFile and the recycle bin is mentioned in the detail column. If a file is deleted directly, the operation is SetDispositionInformationFile and the detail is "Delete: True". In short, if you can't see what's happening to the file in Process Monitor, then you're using Process Monitor wrong. I suggest trying again. – longneck Jan 15 '13 at 20:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.