Hi,
We have an incident wherein the packages are removed from the DP's with machine account.

ISSUE: Packages removed from the DPs.
The package was successfully copied to all the DPs on Friday however, today early morning the packages were missing from the DPs.

The logs mention the details of package being removed with the Machine account.

SMS Distribution Manager successfully removed package "C00007C5" from distribution point "["Display=\\DP_NAME\"]MSWNET:["SMS_SITE=820"]\\DP_NAME\".

The only distinguishing factor i could find in the distmgr log shows the below
STATMSG: ID=2330 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=AUDEMPSSSS01 SITE=806 PID=2232 TID=3872 GMTDATE=Mon Jan 06 01:52:42.099 2014 ISTR0="C00007C5" ISTR1="["Display=\\DP_NAME\"]MSWNET:["SMS_SITE=806"]\\DP_NAME\" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=2 AID0=400 AVAL0="C00007C5" AID1=404 AVAL1="["Display=\\DP_NAME\"]MSWNET:["SMS_SITE=806"]\\DP_NAME\" SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 3872 (0x0F20)

Updating package info for package C00007C5 SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
Package C00007C5 does not have a preferred sender. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
Sent package server list to parent site R08 for package C00007C5 SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)

StoredPkgVersion (2) of package C00007C5. StoredPkgVersion in database is 2. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
SourceVersion (3) of package C00007C5. SourceVersion in database is 3. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)

STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=AUDEMPSSSS01 SITE=806 PID=2232 TID=5128 GMTDATE=Mon Jan 06 01:52:42.114 2014 ISTR0="Update Default User Account Picture" ISTR1="C00007C5" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="C00007C5" SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
Why was this package removed fro

Please verify and share the states messages for that package.

The Status message shows this way

"SMS Distribution Manager successfully removed package "C00007C5" from distribution point "["Display=\\DP_NAME\"]MSWNET:["SMS_SITE=820"]\\DP_NAME\"."

And under the distmgr log,

Updating package info for package C00007C5 SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
Package C00007C5 does not have a preferred sender. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
Sent package server list to parent site R08 for package C00007C5 SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
StoredPkgVersion (2) of package C00007C5. StoredPkgVersion in database is 2. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
SourceVersion (3) of package C00007C5. SourceVersion in database is 3. SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)
STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=AUDEMPSSSS01 SITE=806 PID=2232 TID=5128 GMTDATE=Mon Jan 06 01:52:42.114 2014 ISTR0="Update Default User Account Picture" ISTR1="C00007C5" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="C00007C5" SMS_DISTRIBUTION_MANAGER 1/6/2014 12:52:42 PM 5128 (0x1408)

I can see the packages were removed with "Machine account"

Why did the machine account delete the package from the DP's?

Does the difference in DB version and Source version of the package make any difference???

Yes it will i think but i doubt its been removed by your AV client is the package having the autorun.inf file in your source of the package if so i doubt your AV consider it as a tread and removing the package ..

can you please ask AV team to exclude the package share and resend it once and check will it last long or its getting removed.