Got a weird one!

[nlinecomputers]

Did you check the AV program logs? Perhaps it was flagged as a virus(false positive) and was being removed?

 

[GTP]

Did you check the AV program logs? Perhaps it was flagged as a virus(false positive) and was being removed?

Yeah, that was the second thing I checked after the Event Logs. It's got Emsisoft Antimalware, as have dozens of other clients with Skype but I thought it prudent to check anyway, JIC.

 

[GTP]

The weirdest part of all this is the fact that it wasn't just disabled or broken - it was completely and utterly gone as if it had never been installed in the first place.
The other weird thing is that Skype would shutdown with the familiar descending close tone that it uses first, then just disappear!
I had a thought it may be something to do with/a problem with Shadow Copies or System Restore where it was resetting to a previous restore point? I experienced this in the past where a client installs some software then later - has a "crash" and upon reboot discover the program missing because Windows has booted to a "Last Known Good Configuration."
There were no reboots involved in this case and I dumped some tools on her desktop when I logged in initially, which stayed there the whole time, so if it was restoring, those files would not have remained there either.
I imaged her drive for future reference because I would really like to know why it did this, but I think if I boot that image on different hardware I may get a different result?

BTW, just on System Restore, has anyone ever had the experience where you put a folder of tools on a client desktop, for diagnosing etc, then remove it when you are finished, only to have it reappear some time later because the customer has had a crash and the computer has used a previous restore point? I'v had it happen a few times. Whilst your working on the system, especially doing updates, Windows creates Restore Points at various times.
The client calls wanting to know what Acronis or HDD Sentinel or System Ninja is, or whatever.
This software is licensed so it is very embarrassing to have to tell the client, after they think they got a fully licensed version of some software, that they (or I) must delete it from their computer!
I try not to put things on their desktop, but some tools run quicker on the computer than from a USB key.

 

[ComputerRepairTech]

hmm did you check tasks on the computer? perhaps some sort of uninstall task was placed but corrupted some how and stuck? I dunno that is a very odd one.

Edit: did you leave procmon running with file monitoring enabled while it removed itself? would have told you which process was removing the file.

 

[GTP]

hmm did you check tasks on the computer? perhaps some sort of uninstall task was placed but corrupted some how and stuck? I dunno that is a very odd one.

Edit: did you leave procmon running with file monitoring enabled while it removed itself? would have told you which process was removing the file.

Yes. No tasks scheduled or running. procmon didn't show anything odd.

 

[Markverhyden]

Yes. No tasks scheduled or running. procmon didn't show anything odd.

When @Barcelona first posted this I did the Goo thing, like I'm sure many others did. I was flabbergasted with the results. Personally I've almost no one that uses Skype. But the few that do use Skype had no problems. Reading through the threads this spans users as well as OS versions. One user had this happen on a W7 machine, not sure what was done to correct it, but came back again a year or two later with W10.

 

[Archon Prime]

I just came across the same thing on my Father's computer. I had Kabuto on there as well and I just happened to notice his computer was in the not-synced list in the dashboard... remoted in... noticed that kabuto was completely gone and Skype was also completely gone. I did a full malware scan including rootkits, did my normal scans for other things as well. Nothing.. clean as a whistle.... so where the hell did Kabuto go and where did Skype go? Nothing in the applications list either. Windows 7 home premium as well.

 

[GTP]

I just came across the same thing on my Father's computer. I had Kabuto on there as well and I just happened to notice his computer was in the not-synced list in the dashboard... remoted in... noticed that kabuto was completely gone and Skype was also completely gone. I did a full malware scan including rootkits, did my normal scans for other things as well. Nothing.. clean as a whistle.... so where the hell did Kabuto go and where did Skype go? Nothing in the applications list either. Windows 7 home premium as well.

Did you find any registry entries , program files or anything else afterwards for Skype or Kabuto?

 

[Archon Prime]

Did you find any registry entries , program files or anything else afterwards for Skype or Kabuto?

Kabuto was there. It was just hiding, though I had to reinstall it again to actually get it to run correctly. As for Skype, nothing. not even registry entries... which I'm REALLY confused about. I tried installing it but the installer stopped responding. I'm going to try screwing around with it later. I'm swamped today.

 

[labtech]

Just a thought, though I have not played or replicated to see if this is an issue at all.
Skype seems to push aggressively to update from the local app to an online version. Is it possible that the end user is updating to the online ver, thus causing the local app to disappear?!?

 

[GTP]

Is it possible that the end user is updating to the online ver, thus causing the local app to disappear?!?

No, She wouldn't know how to do that anyway.

 

[GTP]

As for Skype, nothing. not even registry entries... which I'm REALLY confused about. I tried installing it but the installer stopped responding. I'm going to try screwing around with it later.

Yeah, I had problems with the installer "stalling" as well, but after a few minutes it would proceed normally.
Incidentally, after each time Skype disappeared I looked for any .xml, .png, .ini, .config, .sys, .dll, .exe or any other files associated with Skype. There were none!