What would cause an .exe to vanish without a trace?

1

I have a few computers. One computer, at home, one day suddenly had its pgbouncer.exe vanish. The antivirus didn't have it in its virus chest [avast]. I couldn't find the bgbouncer anywhere. All the other pgbouncer files remained where they used to be, except the exe had vanished. I hadn't uninstalled it, nor had anyone else used the machine. I hadn't installed any new software since the previous time I had used it either.

Just now, however, my TV computer was running out of disk space, which was weird because I had python setup to do transcoding and archiving. I logged in and voila! python.exe had vanished !! Once again, Avast.exe didn't have it in its virus chest, and dunno!

I do this time, with the TV computer, know exactly the date that python vanished. Sat the 18th my python scripts ran fine. Sat the 19th python was gone.

I'm going to do some hunting in the event log to see what happened that day. But if anyone has experienced vanishings before and has a clue what happened, I would like to know.

FYI: Both computers (bgbouncer vanish and python vanish) were running Win7 with the RDP hack and both on SSDs and both with Avast. Both computers had all windows updates set to manual(to prevent random stuff changing!) and neither had recently had any windows updates manually applied.

FYI2: Tv computer had since the beginning of October dropbox running all the time trying to download two files. Sadly, a temporary download of each of these two files by dropbox resulted in Avast freaking out and virus-chesting them, and then dropbox downloading them partially again, before being dropboxed. Now, these two files were binaries from a program I had personally written and were clean on other machines. Since the python vanishing I have deleted these two binaries from dropbox (using the website) and dropbox exe on the tv computer is now at peace. I don't think this should cause python.exe to vanish though :/

New edit: On the 18/10/2013, at 0742 my python script ended with an error: "file still in use" which was unexpected but I shrugged it off since sometimes media portal doesn't release the recording. But on second thoughts is weird since the show in use would have been finished recording the day before.

On the 18/10/2013 at 0807 the windows event log complains that several drivers required for CutePDF, send to onenote 2010, send to onenote 2013, microsoft xps document writer aren't installed. I just checked now and indeed those printers have vanished!

New update! I found my python.exe that had been removed. It was still in the C:\Python33\ directory except it had been renamed to a random string charater.tmp (ie, it was made into a temp file) with a creation date of 19/10/2013 at 0600:02 am. Now, the computer normally wakes at 6am to do transcoding. What could have moved my python file into a tmp file?

Peter pete

Posted 2013-10-25T13:22:26.247

Reputation: 179

Are the SSD's on both machines the same model? If you bought them together I suspect it's possible there could be a firmware bug or something on both drives. Also, try checking the drives on both machines for errors. Alternatively, maybe there is some strange undetected malware up to no good, or a third-party utility that's gone crazy? Lastly, it is a bit of a coincidence that both machines have Avast, so you might want to double check its own logs in case it did something. – James P – 2013-10-25T13:29:25.920

TV server SSD is Corsair P128 and it's 4years oldish. Other computer SSD is Samsung 830 and about a year old. Acronis reports the TV server SSD is ok. Samsung 830 I can't check as that laptop seems to have separate hardware issues. Yes. Avast is common. its logs say nothing. – Peter pete – 2013-10-25T13:35:57.330

I'm updating Windoze Defender and Avast and i'll do a fullscan overnight. I'll report back tomorrow. – Peter pete – 2013-10-25T13:43:03.623

Windoze Defender finds nothing, Avast finds nothing. Sadly, I cannot virus-scan the TV recordings because scanning 3TB is not feasible. The SSD system drive is fine though. – Peter pete – 2013-10-25T14:37:17.437

No answers