True, but in this case it seems worth doing due to the relatively patient, selective nature of the attack - it would at least clean out a compromised Notepad++ if it had not spread to a wider system compromise yet.