We have had this experience in a production application. Until recently it was only run.jar and sometimes a few other jar files in the same folder (bin). We recently have seen many more files missing and in a few cases the mysql data files (data\mysql\data\ib*) have been deleted!
We use the JavaService wrapper to launch JBoss. Do you?
We have suspicion this may be occuruing after a Microsoft update. We have many Linux instances in prodcution and have never seen this occur. It only occurs under windows.
Have you leanred any more about this?
Thanks, Dowell firstname.lastname@example.org
Thanks for the suggestion.
We were able to turn on monitoring starting just after boot up using the monitoring tool from sysinternals. We have discovered that smss.exe is trying to delete all files in our installtion folder but it only deletes a few then fails to delete most. smss.exe is a Microsoft process. It is called the Windows Session Manager. Our initial research suggests this is not some virus masquerading as smss.exe. It is in system32 folder. We compared it to other smss.exe files on other PCs and they are the same.
So what the heck!!!! smss.exe is attacking us. We are going to experiment and relocate our standard installtion from c:\<foldername> to c:\Program Files\<foldername> and see if the problem goes away.
This deletion problem has become more common since Windows7. It was rare before that and even under Windows7 it does not always happen.
Any ideas or comments? It is very bizzare that smss.exe is doing this.
BTW: our test was on a fresh install of Windows7 so as to remove any doubts about previous software or possible viruses. We installed Win7 then our app. it was running fine. We rebooted and smss.exe started deleting files. (per the monitoring tool)
Actually, Program Files is the worst place possible to locate JBoss AS. First. some Java libraries cannot handle spaces in the path. Second, if you are using Windows Server 2003, Server 2008, Vista, or 7, Program Files is treated as a special directory and protected in surprising ways. For example, I recall in Vista, with UAE on, editing config files in Program Files and having that configuration either appear or not appear depending on how I was logged in and whether or not UAE was turned on or off - apparently Windows was "protecting" Program Files by making shadonw changes in another location.
There must be something else going on with your system because I have been running Windows 7 for over a year, and JBoss AS on various flavors of Wundows for many years, and have neve run into the problem that you are reporting. And I do have at least one machine where I am running JBoss AS as a service.
I see that you are using Java Service Wrapper. I hope that is the one from Tanuki (there is another with a similar name that is not recommended). I recommend using the service.bat (and jbosssvc.exe) that comes with JBoss AS 5.x - I use that with AS 4.2.3.
We already planned to make changes to use jbosssvc.exe but have not yet done so.
The things you mentioned about Program Files is why we are not currently using it as the target folder. I think we may be using the non-recommened JavaService utility by Alexandria. We have been using it for years before we learned of the problems.
Thanks for your help.
Maybe since we are launching with JavaService this is somehow trigering the attack we are experiencing.