A running windows service is stopped and deleted in a Windows Server 2012 R2 environment

See more:

Windows

server

My application consists of a c# client talking to a Windows service (the "server" code). This service talks to SQL Server and another service. Everything worked great after installation for some period of time (an hour or so) and then stopped. Upon investigation, we noticed that service's executable was missing from the installation directory and could not be located on the machine.

- The PC is running Windows Server 2012 R2 and is connected to a network running Windows Server 2012 R2

- We could not find antivirus code on the PC

- If we manually restore the service exe, Windows refuses to start it

- This is all in a remote site which we can connect to but no one there has any ideas.

- This all runs fine everywhere else we have installed it

Some questions:

1. Can some remotely running antivirus code delete a file on a client or quarantine it where we can't find it?

2. Is there something in Windows Server 2012 R2 that does such things? Can we disable it or add an exception for our service?

3, Can a group policy do such things?

We are at a loss as to where to look...

Thanks,
Pat