How to stop Win 11 from removing SOME applications?

Back to Giveaway of the Day

Giveaway of the Day Forums » General discussion

How to stop Win 11 from removing SOME applications?

(14 posts) (3 voices)

Started 2 weeks ago by Dragonlair
Latest reply from Dragonlair

Dragonlair
Member

Since I upgraded to Win 11 some months back, most of my existing software has worked fine. However, there are two products (from the same company) that intermittently just disappear! Sometimes, I notice it because the shortcut changes it's icon from the normal product to the generic Windows icon (like a newspaper page). If I try the icon (in either normal or generic situation), I get a message that the file I'm trying to execute has been removed or moved. When I look, the sub-folders are there and the uninstall is there but the main executable is GONE!

I never get a message beforehand. Just in the past few days, I ran one of the products and it was fine. Two days later - with NO change in my system other than data files added - it was gone.

I can usually get it back (at least to a slightly earlier version) by using the backup copy of the install executable but I shouldn't have to do that. I also often have to install twice because of updates. One of the two sometimes loses it's "registration".

Why is this happening and how do I stop it? I don't want "white-list" the two products in case they are somehow "infected" later.

This never happened with Win 10. I've had these two products for a couple of years with no issues. This only started AFTER I upgraded to win 11.

Any ideas on what to do? Their software support wanted me to install anydesk and I refused. It's intermittent so that wouldn't help anyway!

Posted 2 weeks ago #
ChrisS
Administrator

It sounds like your anti-virus is removing the software and, if so, there should be notification to that effect in the anti-virus software.

If that is the issue then I'd upload the files flagged as "suspicious" to Virustotal and see if it's a false positive.

If you want to keep using it then you can:

a) As you mentioned, white-list the software

b) Make it portable. These instructions generally work for me How to Create Portable Version of Applications for Windows. However, making the program portable won't really get around a concern for malware. You'll likely just get a notification when you try to run it and you can then decide what to do.

c) Install the program in a sandbox and any bad actions will be limited to the sandbox. You can still transfer data in/out but the sandbox will keep your system safe. I use Sandboxie-Plus and deny the program access to the internet unless it's actually needed.

d) Install the program in a VM. A sandbox is a mini-VM, it contains the program files but doesn't have the vast majority of your system files. If you're trying to run older programs then a VM can be very useful because you can prevent updates and security issues by not allowing it access to the internet.

Posted 2 weeks ago #
mikiem2
Moderator

FWIW I agree with Chris -- I've had Defender remove an app's .exe file silently. We've got McAfee on some devices, and Bitdefender on our main copies of Win11 that we use daily, and both of those will notify you that they're quarantining whatever. When you open Windows Security -- click the icon in the notification area of the taskbar -- then click Virus & threat protection, the page has links for Allowed Threats, Protection History [where you'd confirm the file was removed], & Manage settings. Clicking the last one, at the bottom of the page you'll see a link to Add or remove exclusions, where you can tell Defender to leave selected files alone.

As far as figuring out if the .exe file is a threat, I have less faith than Chris in VirusTotal -- if it's a false positive there's a chance that's VirusTotal's response too, since if it's an older app no one might complain to set the record straight. You should however be able to find out its threat status just by Googling the app's name and something like security vulnerability or CVE. You can also check CVE, searching on the app's name -- cve[.]org or cve.mitre[.]org

If there is a vulnerability that you're concerned about -- you may find it has a CVE but someone needs hands-on access to exploit it, so you're not too worried, or OTOH you might find it's a critical threat -- a VM can be a good solution to isolate the effects if it is exploited. In VirtualBox, which is what I use, you get files into and out of the VM using a network connection to the host copy of Windows, so it's not normally useful to turn off networking for the VM -- I think you'd block it from the internet at the firewall instead if that's what you wanted. You can also limit things using the firewall in the VM's OS [Windows]. And you can isolate it a bit further by using a USB WiFi adapter connected solely to the VM.

Posted 2 weeks ago #
ChrisS
Administrator

In VirtualBox, which is what I use, you get files into and out of the VM using a network connection to the host copy of Windows

If you install the "Guest Additions" then you can use the 'Settings | Shared Folders' feature which allows you to access files on the Host without any networking in the Guest. The mapped folder will show up under "This PC" or "My Computer", depending on the OS you're running, rather than under "Network".

Posted 2 weeks ago #
mikiem2
Moderator

Hmmm... led me down a bit of a rabbit hole... I haven't done much with V/Box networking -- haven't had to -- as using a paravirtual network driver & NAT have done what's needed & served me fairly well. 4-6 versions back I think the V/Box default NAT network stopped working after the version update. While I was trying to get it working again -- had to install a new NAT network -- sharing a folder on the host didn't work. I assumed [wrongly it turns out] that the network connection had to be working for folder sharing to work, but it looks like it's deeper than that. Folder sharing works with the NAT disabled, and with the V/Box network adapter disabled. So far it doesn't look like there's a way to isolate V/Box, and thus a guest OS from seeing files/folders on the host OS -- removing the NAT network may or may not do it, but I'll wait until I do the backup after next Tuesday's update to try that. If it does isolate the VM then I can look at the other network modes, e.g., bridged. If it doesn't, and it may not since, from the manual: "... VM has access to the host's loopback interface and the network services running on it.", I think I might use Windows sandbox instead if/when I want to test apps etc. that I feel are a bit sketchy. Software that plays by the rules wouldn't be a problem, but I'm afraid malware might be able to jump the gap.

Posted 2 weeks ago #
Dragonlair
Member

Since I NEVER let any install go to Program Files or Program Files (x86) unless I have to (CCleaner is a rare exception because I can't easily install elsewhere), I scanned the folders involved carefully and just put the two .exe files involved in the exception list. The folders are so clean of "garbage" that the main folder for each product is only about 3 files (including the exe and uninstall) plus a few folders.

I never had this issue before and I do thank mikiem2 for revealing that this sort of thing has happened to others. It's odd that it's just these two products. I have 3 or 4 others from this same company that haven't had this happen (knock on wood).

Since I did use one of the two this morning and saw the other file, I hope I'm safe for now.

BTW - I don't want McAfee because of its overhead. The last computer I had that came WITH it took me FOREVER, even using their tools, to get all of it out of the system! I've had one computer literally hang because of the anti-virus taking to many resources.

Posted 2 weeks ago #
mikiem2
Moderator

I use McAfee for most of our stuff because it's Much less resource hungry than Bitdefender, which makes our laptop with an Intel i3 just crawl, and because I get it cheap -- I buy McAfee LiveSafe, which covers unlimited devices, at Office Depot during their Black Friday sale for $10. It didn't used to let me add the new key when a license expired, so I had to uninstall it using the normal uninstaller, then use their special tool to remove most [they claim all] traces, then reinstall & activate the new subscription. You are correct -- McAfee sends lots of roots deep into Windows.

Posted 2 weeks ago #
Dragonlair
Member

It didn't work!!!! I used one of the products yesterday. Last night I let the Patch Tuesday updates go and this morning I did my weekly full scan of the main hard drive. AFTER those things were done, I noticed that one of the two products had lost its .exe file again.

I've never run Defender and had it find something and remove/quarantine it without my notification! I don't think it was Defender clobbering those two files. I never have had both be removed at the same time, it's either one or the other.

At first, I was thinking that something went weird with the normal Patch Tuesday update but that didn't seem to make sense. Most of the removals are not timed that way.

I THINK the problem may be CCleaner! I always run it just before I run the full-disk anti-virus to clean out the garbage before the anti-virus has to bother with it. I have added the two installed product folders to the exclusion list of CCleaner to try to prevent this.

I have also created, in each folder, a "Protect me.zip" file with a copy of the .exe in it. If it happens again, I shouldn't have to re-install, just copy that out of the zip.

I have a possible alternative to cleaning the registry. Is there an alternative to cleaning out the recycle bin, temp files, and cache for Firefox and Edge? I'm not all that happy with CCleaner for this and other reasons. I mean a free alternative - I am using the free version of CCleaner.

Posted 1 week ago #
ChrisS
Administrator

CCleaner only removes junk files, it won't remove your program unless you use the uninstaller under "tools". It's most likely either Windows Defender or Windows Update that caused the program.

You've probably already done it but check Windows Defender first since it's easier:

Go to Start|Settings|Privacy & Security|Windows Security|Virus & threat protection|Protection history and see if your program is listed. (If you have a long list click "Filters" on the top right, select "removed")

If that doesnt work then maybe one of the following PowerShell commands will help.

Open PowerShell (type powershell in the search box and open the application)

Find Programs uninstalled with MsInstaller:
Copy and paste: Get-WinEvent -FilterHashtable @{LogName="Application";ID=11724;ProviderName='MsiInstaller'} | Select TimeCreated,Message (and press enter)

See if your program is on the list.

Convert and combine the WindowsUpdate logs
Copy and paste: Get-WindowsUpdateLog -logpath C:\temp\WindowsUpdate.log (and press enter)

Open Explorer, navigate to C:\temp and open the WindowsUpdate.log file in Notepad or your preferred text editor. Search the file for the program that's missing or the publisher.

If the program was uninstalled outside of MsInstaller then the first PowerShell command won't find it. I also don't know how programs that Windows Update uninstalls (or, more accurately, doesn't reinstall) are listed.

Posted 1 week ago #
mikiem2
Moderator

You *might* be able to find a log entry for a deleted file, though *if* I remember correctly you *might* have to set policy to log file deletions. I did a quick Google and could only come up with this:
insiderthreatmatrix[.]org/detections/DT003

Process Monitor will work, but not knowing when the file is going to be deleted [or moved/quarantined] you'd be capturing an awful lot of useless data, though the filtering should make it doable.

learn.microsoft[.]com/en-us/sysinternals/downloads/procmon

There's an easy to use Microsoft app in the Store called PC Manager that you might take a quick look at for deleting those cache files. Personally I like KCleaner PRO, a prior GOTD -- filecr[.]com/windows/kc-softwares-kcleaner-pro/ Neither will do anything with the registry however.

Posted 1 week ago #
Dragonlair
Member

That didn't get me anything!

Defender -> shows NOTHING after 9/23/24 (that may have been before I updated to Win 11)

Powershell -> last item was 2/15/25 (not a time I lost either program) - had a message of "Office 16 Click-to-run Licensing Component". There were 4 or 5 other dates listed - exact same message.

The other Powershell message gave me nothing understandable.

File Explorer -> There IS NO FOLDER called C:\Temp! I turned on hidden files and could not find it. I found a couple of temp folders here and there but no just plain Temp.

Anytime that Defender has ever found anything, it quarantines it and tells me that it has done it to give me a chance to remove the file or release it from Quarantine. It's never taken just ONE file from a folder.

As I indicated, I do not install into Program Files or Program Files (x86) unless there isn't a way around it easily. Off hand, the only products that don't allow me to specify or don't have an easy way to work around it are kindle (installs in the user area) and CCleaner (Program Files). I install into C:\Products with sub-folders for Basic, Games, General, and Hobbies. In this case, the two products are from Epubor and are in C:\Products\General\Epubor. There are several other Epubor products in that same folder that have never been touched. None of the other products in any other folder there has been touched.

I can't figure it out and can hope that the idea of making zipped backups of the two .exe files will at least make it easier to get them back if they go away again.

Obviously, tagging them as exclusions for Defender was useless.

BTW - I did contact Epubor and they're only suggestion was to install a product for them to access my computer remotely (not an option AT ALL to me). If it's intermittent, not much chance of it working anyway.

Posted 1 week ago #
ChrisS
Administrator

I should have specified that you'd need to create the C:\temp directory if it didn't exist or simply change that part of the command to a directory that already exists.

However, it really doesn't seem like a Windows Update issue because Windows Update would remove everything. It sounds like a security program is deleting it. Are you running any other malware/spyware programs?

You could try re-installing the program, download and run AdwCleaner from Malwarebytes to see if it complains about the program being a PUP and then run a dedicated Windows Defender scan.

The only other suggestion I have is don't run CCleaner as part of your normal routine until you've isolated the problem. It might be "cleaning" the log files that you need.

Edit - I'm wondering if you don't have the Defender notifications turned off (or, they somehow got switched off). I can't find where the "turn notifications on/off" switch is for Defender but it's probably in such an obvious location that I'll never find it.

Posted 1 week ago #
mikiem2
Moderator

Well, if you're OK with just having a zipped copy of the files for when they're deleted, there's nothing wrong with that IMHO. In theory you could just do a manual scan with Defender and that would tell you if Defender just doesn't like the files. In practice however, there just isn't much info on Defender's Cloud Delivered security, which is turned on by default I think. From what little I've found it *seems* to be separate from the basic Defender engine, and may or may not share notifications or history with Defender. And having a file Zipped does not hide it from Defender, so if it is Defender itself, and not the cloud based service, I'd think you'd have lost those zipped copies by now. If you wanted to try turning it off, if the files no longer disappear you know it's the culprit. If you find out what's happening, which is going to be a hassle if you used Process Monitor for example, you can deal with it, but otherwise it's gonna be trial and error. One other thing that occurred to me that you might try, and I've no idea if it would make any difference, would be to right click the folder with the app, click properties -> advanced, and check the box for encryption. I don't know if that would deny access to whatever app or process is causing the headache, but it would be easy enough to make a Zipped copy of the folder, and if encryption made no difference, get rid of it and restore the old one [or turn off encryption, whichever's quickest/easiest].

I don't use CCleaner. The PC Mgr alternative I mentioned gets installed with the other Store apps, while KCleaner has a fully portable version that can be stored anywhere.

Posted 1 week ago #
Dragonlair
Member

I had the two exe files, just those two files in the Defender exclusion list and one disappeared anyway. I have .zip extension on the exclusion list. If I didn't, the time for a full scan would be much longer as that type of file is used a lot and always has been. It does seem to leave them alone.

I'll try to make it a habit to look at the start menu each time I open it to watch those two icons. Usually, the first indication is they change to the default icon (looks like a newspaper page - blue center and lines on both sides).

Posted 1 week ago #

RSS feed for this topic

Reply

You must log in to post.