Someone mentioned antivirus and custom code... it reminded me of when Symantec Endpoint Protection received an update and some of our production servers had our custom apps quarantined. We had about four servers that had most of our custom apps removed. When it happened I thought someone was monkeying with the servers (they were our task servers used for task and service jobs). It took me about an hour to realize what happened then another hour to get the SEP admins to disable it until we could get another patch. Fun day.