Hi Matt, yes, I was able to see some $~ files in the data directory on the server. I tried to launch them, and they opened in ProSeries. I don't have a ProSeries account so didn't sign in to verify if they were the missing files or not. 

My question is, this only seems to happen to my customer after they e-file returns. Unclear if it's all returns that get e-filed, or just some of them. Is there a way to prevent this from happening? We have already set the AV exceptions on the server, and the problem has persisted since that point.