0

I created one service in C# and created installer for that.Installer is working fine and service is installed properly on server. But here is one problem. When server restarts the program connected to service automatically getting deleted from C:\ProgrameFiles location, but service is still there and when restarting this service. I am getting prompt like "windows can not find specified program path". Can somebody help me what I am missing here or what is potential cause for this problem?

I know the the scope of this question is too broad to answer but still I want some hints or any solution to resolve this issue. I tried to searching many forums but unfortuanatly no luck. please consider while vote to closing this question. I can edit more to clarify this scenario.

Thanks.

Stein Åsmul
  • 39,960
  • 25
  • 91
  • 164
Rajput
  • 2,597
  • 16
  • 29
  • Please make a log and put it somewhere where we can get the whole thing. Is this an old installation or did it happen after the first reboot? [**MSI logging primer**](https://stackoverflow.com/a/54458890/129130). – Stein Åsmul Aug 06 '19 at 11:33
  • Did you install an upgrade to this MSI package, and then the file disappeared after a reboot? Did that upgrade try to downgrade the file to a previous version? – Stein Åsmul Aug 06 '19 at 13:12
  • Nope. This service was installed first time on server and being removed everytime whenever server reboots. – Rajput Aug 06 '19 at 14:02
  • Have you checked your Anti Virus logs? Have you checked the Event Viewer? Is the file in question set as a key path? – Captain_Planet Aug 06 '19 at 14:49
  • Yes, very good point, try to upload the file in question to [virustotal.com](http://www.virustotal.com) to check it with many malware scanners and also check the malware scan logs locally on the box of course. It is odd that the first start of the service did not trigger the quarantine though. – Stein Åsmul Aug 06 '19 at 15:34
  • @Rajput Is this a server running as a virtual machine? – Stein Åsmul Aug 07 '19 at 19:06
  • 1
    Any luck with this? – Stein Åsmul Aug 16 '19 at 22:22
  • yes, we have done, Now we awaiting for next server start date. thanks :) – Rajput Aug 17 '19 at 10:02
  • One more issue, might not be relevant here: some icons get hidden on Windows 8 onwards. But this issue seems different. I will just slide it into the list below for the future. – Stein Åsmul Aug 20 '19 at 01:57

1 Answers1

1
  • What kind of server is this? Terminal server?
  • UPDATE: It isn't a virtual machine is it? If so, are the disks set fully persistent? See 9.
  • If you run repair on the MSI in question, does the file come back?
  • What happens if you check the file directly with your malware scanner?
  • If you shut down the service manually, is the file still there? (just to be sure). Try repeatedly stopping and starting the service a few times.
  • Did you verify that the service runs from where you expect after installation? (have to ask)
  • Do you install per-machine or per-user?

Debugging

Check the event viewer and the MSI log files:

MSI Logging: Installsite: MSI log "how-to" and / or More MSI logging information.

Event Viewer: Hold down Windows Key, tap R, type eventvwr.msc and press Enter. Go to Windows Logs => Applications. Look for MsiInstaller events. Check the other logs too (Security, System, Configuration).

Deployment Mnemonic: And a "deployment mnemonic" (yellow section) - some heuristics to think about deployment problems.

Some Ideas

Loose Cannon: While we wait for feedback from you, let's fire off a list of suggestions shooting from the hip. Some of these are bad or eliminated as causes, let's just list all to remember the bad ones too:

1) Quarantined malware? (real or false positive, doesn't matter which). The file gets quarantined on every reboot? Upload file(s) to virustotal.com to check binaries that are missing. Do an administrative installation if you need to get hold of the files.

2) Upgrade Problem? (not the cause in this case, but MSI major upgrade can cause this kind of problem - for example when you attempt to downgrade a file to a lower version).

3) System policies? Not really familiar with what policies that could delete files - if any at all. Just mentioning that a lot of policies can affect Windows in general. Check the event logs. Some registry keys are periodically overwritten for example with defined AD settings.

4) Cleanup Scripts? Anything is possible here, but it would be strange to delete a pinpointed executable? Check what runs on boot? Autoruns. Run that tool and have a look at auto-starting binaries - there are a lot on most systems.

5) System Restore? Not relevant here as far as I can tell, but system restore can do VERY strange things such as delete single files from somewhere unexpected out of the blue. Yes, I have seen it (not a fanboyism - I was there - in the fires of mount Doom - it really happened).

6) Recovery hardware? Some computers have hardware devices that restore the system to earlier states on reboot with various options to allow some persistence here and there. No idea how prevailing these are now, but I expect their use for quick malware recovery and stuff like that. Talk to your system administrators?

7) Permissions? Does the package apply ACL permissions to the folder in question? It shouldn't cause this problem, but maybe check it. The service should never be able to start at all if permissioning is wrong.

8) Disk Corruption? An issue that one must always check for.

9) Virtual Machine? One issue that came to mind is whether this server is running as a virtual machine and if so whether the disk setup is one of full persistence? Not sure what is technically possible here at the current day and time.

10) Hidden Icons? One more issue - added in a hurry - some icons can be hidden in the Windows start menu from Windows 8 upwards (I believe, details fuzzy). I suppose this can yield the impression that a product has been uninstalled, when it is just hidden. Almost certainly not relevant for your situation.

Questions

PendingFileRenameOperations: After installation, are there entries in PendingFileRenameOperations? Check BEFORE installation as well.

Rollback: Even more obscure, is rollback disabled for Windows Installer? I can't see how that would cause this problem, but it is possible to do and what it triggers and makes possible I am not sure of.

Bitness Confusion: It is possible that people just think that files are missing, because they are looking in the wrong folder (x86 instead of x64 or vice versa). Not relevant here (then the service would start - unless there is something else wrong), but listed to remember it for other, similar cases.

"Out There": This is C:\Program Files\ right? Not C:\ProgramData\? Are there any mounted disks on the NTFS partition? Any symbolic links? Roaming profiles? Do you install per-machine or per-user?

Stein Åsmul
  • 39,960
  • 25
  • 91
  • 164