applicationHost.config and redirection.config deleting!! please help me

Hi @Abdulazeez Asaju ,

Thank you so much for coming back and sharing the solution.

Since this may help others who run into the same behavior, so I would like to make a short summary of the issue.

Issue:

applicationHost.config and redirection.config kept disappearing from the IIS config folder. They could be restored in Safe Mode but were gone again after a normal boot. The cause was a malicious driver that loaded during a normal Windows startup and was hiding or removing them.

Solution:

Windows Defender detected the threat, but it kept returning when removed during a normal boot. OP traced the driver in Safe Mode and disabled it there, and after restarting normally, applicationHost.config and redirection.config stayed in place and IIS worked again.

One thing worth keeping in mind is that disabling a driver stops it from loading but leaves it on the system. Since it was there before the server was purchased and survived a reinstall, the base image is the likely source, so a clean image from the provider would be the safer long-term fix.

If you find this answer helpful, I would greatly appreciate it if you could follow the instructions here so others with the same problem can benefit as well. Thank you.

Hi @Abdulazeez Asaju ,

The Safe Mode behavior suggests that something loading during a normal startup may be hiding or removing these files. I cannot confirm the cause from the available information, but this does not look like a normal IIS configuration problem.

A similar case was eventually traced to malware using a driver to hide files. This does not confirm that your server has the same problem, but the symptoms are close enough that I would check for it before rebuilding the server again.

Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classifies as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

I would temporarily disconnect the server from public access and run these commands from an elevated PowerShell window:

Get-WebGlobalModule | Select-Object Name, Image
driverquery /v

Check for any IIS module or driver that you do not recognize, but do not remove anything until it has been identified. I would also run Microsoft Defender Offline and check whether the sites' web.config files contain a hardcoded <machineKey> copied from public documentation or another server.

If an unfamiliar module, driver, or reused public machine key is found, the server may be compromised. Restoring only the IIS files or reinstalling Windows and restoring the same site configuration, may allow the problem to return. In that situation, your security administrator or Microsoft Support would need to investigate the server directly.

If you found my response helpful or informative, I would greatly appreciate it if you could follow this guidance. Thank you.