.net forms keep disappearing due to TaskManagerClosing

So this one has me stumped, and seems really odd. I wrote some c# forms which act as the "server" component in a client server app setup. (Client sends udp data, server program chugs some numbers and send back results.) Due to various reasons, there are 4 instances of 1 form and 1 instance of another form all running at the same time. And I have a bat file that automatically starts all these forms in case of a power reset.

Anyways, so I am trying to leave this running all the time and have them be somewhat reliable. It was working fine a month ago, but over the past few weeks i have noticed they have been disappearing. Sometimes they stay up for a day, sometimes 4, but then just disappear. (Up until the last occurance they would all disappear seemingly at the same time, but i wasn't watching so i couldn't be sure. This last time the one different form stayed running for some reason.)

So I added some logging and found that all the forms do disappear at the same second, and the _FormClosing event shows a CloseReason of TaskManagerClosing.

I know for开发者_如何学运维 a fact no other person has physical access to the machine.

What could cause this to happen? Anybody else starting to think maybe my computer is infected?? Just a thought, but this behaviour would be odd for malware or a virus anyways. Especially since everything else on the computer seems to behave just fine. That said I do have tightVNC installed, maybe that isn't that secure.

Other than that there isn't much else, maybe antivirus software or Ad-Aware is closing the forms??

Thoughts? Thanks in Advance.

---

Just some thoughts, since this does seem very odd.

First, the MSDN documentation is misleading when it states that CloseReason.TaskManagerClosing indicates that "Windows Task Manager is closing the application". It appears, rather, that the CloseReason.TaskManagerClosing is set as the close reason when the window receives a WM_CLOSE message (0x10), which could originate from any process on the system, and not necessarily Task Manager.

This raises the question: why is WM_CLOSE being called on these processes? One possibility is that listening for UDP packets is triggering a rule-based filter on the security software (virus/adware), which may show up in the software and Windows event logs around the time the processes are closed. Beyond that, it's difficult to diagnose without knowing the owning process.

While it doesn't address the root cause, one practical option is simply to cancel the WM_CLOSE request in response to the FormClosing event.

        if (e.CloseReason == CloseReason.TaskManagerClosing)
            e.Cancel = true;

Another option is to restructure the software as a Windows service rather than a application. Services tend to be better-suited for server-type applications, since they run in their own user session. But it would also require separating the user interface functionality from the server functionality, and also wouldn't address the underlying problem.

Finally, if this is a server, you might want to revisit any installed services or utilities that may be extraneous and somehow sending the WM_CLOSE command to the application instances. In addition, moving the server application instances to a clean server might be a practical approach to isolating the issue.