WinSCP quietly deleted from Windows 10 machine

I use WinSCP as a script as part of another program. I installed WinSCP on this machine about 1 year ago. I never use the WinSCP UI. About 4 or 5 days ago my script failed because it couldn't find the WinSCP executable. The WinSCP folder no longer existed, WinSCP wasn't on my path. I assumed I might have accidently uninstalled it while cleaning up something else. I reinstalled the lasted version of WinSCP and my script worked again.

The next day when I left my computer on but unused for several hours. I ran the script that used WinSCP and again it couldn't find WinSCP. This time the folder existed but only contained a single dll, DragExt64.dll I think. I looked to see if Windows Security showed any events but couldn't find anything. After looking at Windows Security I thought the problem might be the Reputation-based protection. I didn't see anything under the protection history but I decided to turn off "Check apps and files". I have no idea if this was the problem. I'll leave my computer off when not using it to see.

Has anyone seen this type of problem? Windows 10 silently uninstalling WinSCP?

I've never heard of this. I'm pretty sure it's not Windows that uninstalls WinSCP. Is it a work computer?

It's a personal computer running Windows 10 Pro. I just had WinSCP disappear after a restart. I've been checking that WinSCP exists every time I walk away from the computer, come back or shutdown so I'm sure it was there when I shut down. I've turned off every program that starts automatically, mostly Intuit stuff for QuickBooks. Running Windows Malicious Software Removal Tool to see if it finds anything odd.

Is it a regular WinSCP installation or a Microsoft Store installation?

It's a regular installation.

I'm sorry, I do not know how to help you. I do not remember anyone reporting an issue like this before. Does WinSCP disappear even from the Start menu and the program list in the Settings/Control Panel? (i.e. is it a clean uninstallation?)

Yes, it is a clean uninstall. My assumption is that something is running the install program since WinSCP is removed from the path as well as from the start menu. It is also gone from Manage Programs. The only thing left are registry entries.

WinSCP just uninstalled and of course I forgot to have Process Monitor running because I'd started the computer. I checked that WinSCP was there after startup completed. So I'll be reinstalling and adding Process Monitor to my start up items so next time I hopefully will catch what happened.

Hi there! The same thing happened to me today (or yesterday). I was working with WinSCP just this weekend and it's suddenly gone now. Did you figure out what caused it? I lost all my saved sites after reinstalling, which really sucks. I just hope I can make sure it won't happen again.

Ririshi wrote:

Did you figure out what caused it? I lost all my saved sites after reinstalling, which really sucks.

WinSCP does not uninstall on its own. It's not even possible, you need the administrator permissions to do that.

Also WinSCP uninstaller does not even delete the settings by default. So if you lost even your settings, WinSCP must have been deleted by something else.

That may very well be the case, I am not blaming WinSCP for doing anything wrong here. I just have an issue which I'd like to make sure won't happen again. That's why I asked if OP found out what was happening, so I can keep that in mind in the future.

Is there a program or tool that I can use to find out what caused WinSCP to be deleted, along with the settings?

arpetris wrote:

It's a personal computer running Windows 10 Pro. I just had WinSCP disappear after a restart. I've been checking that WinSCP exists every time I walk away from the computer, come back or shutdown so I'm sure it was there when I shut down. I've turned off every program that starts automatically, mostly Intuit stuff for QuickBooks. Running Windows Malicious Software Removal Tool to see if it finds anything odd.

Hi, just registered to ask a question and saw this.

Haven't read the rules and not sure if I can post a link but can see the "URL" right up there!

I had this issue on few Windows 10 setups where program/ s would disappear after re-boot.

Not sure if you are aware of this or have seen it:

Windows 10 may keep deleting programs and documents after restart because of the defender or the new storage sense feature in Windows 10

Now, back to reading ;)

I didn't find out what was causing the error. If ProcessMonitor was running WinSCP didn't get uninstalled. If ProcessMonitor crashed, WinSCP would get uninstalled. Once I caught an error dialog from WinSCP "Cannot propagate the new environment to other processes. The new value will be available after a reboot. This operation returned because the timeout period expired." I restarted ProcessMonitor then cleared the dialog and found that something had started the WinSCP uninstaller with the command: unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART. Since ProcessMonitor had crashed I didn't catch what started the uninstaller.

I have worked around the problem by renaming the uninstaller. I just added .bak to the file name.

If anyone has any ideas on how to find out what started the installer, I'd be happy to test. I just couldn't take having to reinstall WinSCP daily.

I have prepared a simple console application that prints and logs its ancestor processes.
You can get it from here:
https://winscp.net/public/parentprocess.zip
Try replacing unins000.exe with it.
It logs to %TEMP%\parentprocess_yyyy-mm-dd_hh-mm-ss.log

Woke this am to find that my WinSCP has been removed from my computer. I had multiple sites attached to this. Something about Windows TEN Sux really bad. They get to control what you do? I bet alot of website developers are really going to be upset when this happens to them. I am no longer going to use this product. It's Linux or going backwards from now on.

I had a similar issue just today.
I use the portable version of WinSCP, but I added it to the taskbar. This morning starting the PC I noticed that it has been removed from the taskbar (Win10 PRO)... It seems strange to me.

@Kolopot: So was just the link from the taskbar removed? Or even the actual binary? Where did you place the binary? Did you check a log of your antivirus or Windows Defender? Is it a personal computer or corporate/managed one?