12

Adobe Flash Player is set to automatically check for updates on Windows startup. I've always wondered where exactly it is set to do this. Checking the running services, as well as msconfig does not yield its location. The message in question looks like this: http://www.technipages.com/disable-an-update-to-your-adobe-flash-player-is-available-message-forever.html

I know how to disable it via Adobe's web site (instructions are included in link above), but I'm interested in knowing where exactly in Windows is this set to perform this action? I have done some research on this, and people keep saying to check the following registry locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce or the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

However, I have checked those locations, and I still cannot locate where this updater is stored.

I'm pretty sure that malware also uses this technique to automatically load upon startup, and since it's not in the typical location(s) that a user would look, it's well hidden.

5 Answers 5

11

Exact answer is here. http://forums.adobe.com/thread/750559

This one was an entertaining puzzle, it's probably been answered elsewhere but I thought I'd let curious people know. As someone mentioned, it is the plugin module (NPSWF32.DLL in case of Netscape/Mozilla/Opera plugin) that does the check; thing is, it does not prompt the user to update immediately (it would not be able to do so with the browser open and the DLL in use anyway), but rather it defers the update until the next restart -- by adding a registry entry in HKLM (or HKCU, not positive)\Software\Microsoft\Windows\CurrentVersion\RunOnce key.

The entry is named FlashPlayerUpdate and contains <system root>\System32\Macromed\Flash\FlashUtil<version>_Plugin.exe -update plugin -- presumably the same command line you would run if you wanted to update the player manually (without the hassle with opening and closing your web browsers). The reason you don't see it in registry or with system tools like msconfig.exe is that RunOnce autostart entries are deleted from registry immediately once they are executed. Normally such entries are used by driver and Windows installations to perform one-time initialization after a reboot (once the required services are started and drivers loaded). So you would have seen that entry with msconfig, had you looked at it after the update check (which the plugin does silently), but before the reboot!

5
  • please expand your answer, as link-only answers are discouraged.
    – studiohack
    May 19, 2011 at 2:54
  • His link describes the answer perfectly. A Flash Player DLL checks for updates whenever you are browsing the web, and it schedules a RunOnce registry entry to load at startup to update the Flash Player. Once it updates, the registry entry is deleted. The user account obviously has access to that registry location.
    – Phanto
    May 19, 2011 at 13:00
  • Since people are restarting their computers less than more, you can infer from this answer why flash is not updated on so many computers.
    – anno
    Jun 29, 2011 at 11:04
  • Is the update call now: %windir%\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe -install ? Sep 27, 2011 at 14:10
  • Note: The analogous argument for the ActiveX version is -update activex.
    – a cat
    Feb 13, 2013 at 17:27
2

http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager05.html#118377

it's a setting within the flash player itself, which can be accessed in a roundabout way at that URL, which I found under the How do I change how often I receive notifications of updates? header of another link, but apparently as a new user I can't post more than one URL in an answer (because new users only use the internet one link at a time, I guess?)

3
  • It can't just be Flash Player itself, since the message appears upon OS startup. Somewhere, Windows is automatically loading an update process upon startup to check for updates. I want to find where Windows is loading that process.
    – Phanto
    May 21, 2010 at 12:22
  • Ah, sorry I didn't get back to this... you know about "Start > Run > msconfig" right? Adobe loads a bunch of stuff under the Services and Startup tabs, but I've disabled much of that so I'm not sure if that's what you need...?
    – Ixobelle
    May 27, 2010 at 1:56
  • The odd thing is that it's neither listed under msconfig nor in services.msc. I don't remember if I experienced this on Vista (nor Win7), but I have seen this on XP. Perhaps only XP has this [I have seen it on XP]?
    – Phanto
    May 27, 2010 at 15:53
2

The updater deletes the reg key for running on startup once it loads. See http://www.adobe.com/support/documentation/en/flashplayer/8/releasenotes.html

0

As an aside....

I'm pretty sure that malware also uses this technique to automatically load upon startup, and since it's not in the typical location(s) that a user would look, it's well hidden.

While users seldom look here, this is not what a developer or systems administrator would consider a "hidden" location. It is one of the most commonly used methods to run a program at login or startup, and the only method to explicitly start a program only once.

If you look at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run keys, I'll wager you have at least a dozen programs listed there already. It's standard practice. It's certainly no less obscure than C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

0

I have disabled the services and also readjusted a number of other update services and it was a huge boost for my laptop's performance. You can do that in Task Scheduler (you can find it via Control Panel->Administrative Tools->Task Scheduler).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .