Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone
-
@PeterJones Hi, not the OP but I’m also experiencing this issue. In my case it appeared to disappear from my system as I was logged in. This is actually the second time it’s happened on this machine, but I was convinced the first time was a fluke.
In the Event Viewer, the only MsiInstaller events within the time frame that it happened were associated with the removal of “Office 16 Click-to-Run Extensibility Component” followed a few minutes later with its re-installation and configuration.
I am able to find Notepad++ in Program Files; however inside is only uninstall.exe and a plugins folder that contains ComparePlugin. Note that this is an externally managed computer and if I try to launch uninstall.exe directly, I cannot run it as I’m not an admin. When I view the folder in Program Files I can see the exact time that it was modified. When I go to that time in the Event Viewer, there are 4 identical events logged from ELAN/Service SERVICE_CONTROL_INTERROGATE with the description “The requested section was not present in the activation context”.
Let me know if any other info would be helpful. This is driving me crazy!
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
Let me know if any other info would be helpful. This is driving me crazy!
You first say that it was installed on your PC, and that it was in the Program Files folder. That suggests someone with admin rights (not you as you don’t have admin rights) had installed it. Then you say it has been uninstalled by some process that you unaware of.
Unfortunately about all I can say is that as your PC is “externally managed” you would need to go to that management department and ask them why the uninstall happened, especially as it would seem it was originally sanctioned by someone with admin rights to install it.
There is the portable version of Notepad++ that you can “unzip” into another folder. As it is not “installed” it hopefully won’t be removed by whatever process that caused your previous installation to be removed. There are some caveats with the portable version. The upgrade process is not the same. You can manually upgrade, but each “unzip” will overwrite most of the content of the previous installation meaning any special configuration settings you have created will likely be removed. The online manual has a reference here.
Terry
-
@Terry-R Thanks! I didn’t include this information because I was trying to keep it short, but I have a separate admin account for this machine which I used to do the initial installation. But I use my normal user account 99% of the time, and that’s what I was logged in on when the uninstallation occurred-- I mentioned it just because it shows that I couldn’t have accidentally initiated the uninstallation somehow. I was also working in-person at the computer the entire time. Our IT admins can remotely connect to our computers but they have to request it via a screen share, so I would definitely have known if someone else was controlling my computer. I also imagine it would show up in the Event Viewer.
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
Our IT admins can remotely connect to our computers but they have to request it via a screen share, so I would definitely have known if someone else was controlling my computer.
If they wanted to do something in the GUI, then yes, they’d have to screen share. But Microsoft has tons of command-line commands that are able to launch a background process on another machine; and it’s really easy to uninstall an application using one of those command-line remote commands.
If there’s even a possibility that IT is removing it (and there is), you should talk with them before assuming it’s something with Notepad++. Especially since Notepad++ doesn’t just randomly uninstall itself. (And if it’s not IT, then you need to work with them to run a careful scan of your system to make sure you don’t have a virus or other malware. Because, again, Notepad++ doesn’t just uninstall itself.)
I also imagine it would show up in the Event Viewer.
One would think and hope that it would. But MS has vested a lot of powers in IT, so it might be possible there’s a way for IT to do that without it showing up in Event Viewer. (But I’m not an IT guy, nor an expert at Event Viewer, so this is paragraph is just unfounded speculation on my part.)
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
Our IT admins can remotely connect to our computers but they have to request it via a screen share, so I would definitely have known if someone else was controlling my computer.
Well then even though you installed it it would seem that some “external process” decided it wasn’t permitted and uninstalled it. You will need to search out the answers as from what you have provided thus far, there is no way we can help you.
You have more or less stated there is no log of the uninstall. Now obviously that would seem to be wrong, at least to my knowledge (I work in IT also) there will be a breadcrumb trail somewhere. Perhaps you need to identify what other processes are on your PC. Maybe they write to a different logfile.
As for the IT admins needing to do a “screen share” to conduct work on your PC, that is a fallacy. A lot of work now takes place in PowerShell and can be entirely conducted without the current user being aware of what is happening on their PC. Uninstalls (and installs) are definitely within the realm of PowerShell scripts.
Terry
PS, just saw @PeterJones reply, emulating my sentiments!
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
but I have a separate admin account for this machine which I used to do the initial installation.
I should also ask, that as your PC is “managed” yet you have an admin level account, the suggestion is that there would have been a “disclaimer” and agreement between yourself and IT/Management on what you would use that admin level account for.
Was it permitted that you “install” all and sundry applications? I would suggest not. It would likely be a process of you submitting a request to allow an application, and once they agreed, you could use your admin level account to install it. Through this process, IT would then know what was installed on your PC and (if we are right in our suggestion that IT know why and how it was uninstalled) not conduct an uninstall as it was on their “permitted” list.
Terry
-
@Terry-R The account is precisely so I can install software. In any case I am positive that our IT specifically knows about my use of Notepad++, as in the past they helped me when I had issues trying to default to it for certain extensions; These were officially documented tickets. Thank you for educating me about the possibility of other types of remote control and the suggestion to scan my computer. We have malware and spyware scans that run daily (and there are certain types of software that they do not permit me to install even with my admin account, which I understand and am fine with) but I have never encountered anything like this issue, including with other open source projects, and when I view my protection history, no recent actions have been logged for any of them. This current installation had been created and running without issues since August with daily use.
- “Then you say it has been uninstalled by some process that you unaware of.”
- “Especially since Notepad++ doesn’t just randomly uninstall itself”
- “Because, again, Notepad++ doesn’t just uninstall itself.”
To be clear, I am not accusing Notepad++ of uninstalling itself. If you reread my initial post I NEVER said it uninstalled itself, just that it disappeared, which I hope you agree is accurate. The reason I went about looking for uninstallation events was because you suggested it as part of troubleshooting. If you have other suggestions I am keen to hear them.
In any case, I will open a new ticket with IT and in the meantime use the portable version. I will update with what I find out if it is able to be shared.
Sorry for the edits, this is a last one to tag @PeterJones .
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
If you reread my initial post I NEVER said it uninstalled itself
You eliminated the possibility that you uninstalled it. I was just eliminating another possibility, so that the the focus would lead to the remaining possibilities – IT, malware/malicious-vector, or unexpectedly being uninstalled by some other software (possibly some automation that IT had left on, but didn’t use actively against N++). And note that since none of us users of Notepad++ have access to your machine, then, other than suggesting alternative sources and encouraging you to research event logs, there’s nothing we can do for you, as the problem isn’t with Notepad++. (And again, I am not an expert on event logs. I don’t know what you saw or didn’t see in your event log other than your assertions that you didn’t see anything, nor do I know how to interpret what you saw or didn’t see there even if I knew what that was)
-
@Xue-Davis said in Notepad++ has disappeared from my system, even the folder under "Program Files" on my c: drive is gone:
We have malware and spyware scans that run daily
Recently there was a warning by one (or more) AV systems that a particular version of Notepad++ installation contained a vulnerability. I think it wasn’t so much a vulnerability but more of an overzealous AV engine that wanted to hit any potential issue. I think the post were in the last 2-3 months. Maybe your version was the one mentioned and it got taken out by the AV services. Now AV is unlikely to “uninstall”, it would just remove the structure around the installation until it cannot see any additional vulnerability.
But I think we have helped as much as we can and pointed you in the direction we think will be most promising to determine why.
Terry
PS found it it’s here
-
@Terry-R This is very helpful and I was unaware of that issue. Thank you. Based on dates, it looks like I was using 8.8.5. It seems likely, especially the description of removing the structure around the installation.
