Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

About once a week this program is being run automatically:


I know what it is, and what the updates are, I don't care about that. What I would like to know is how this program is being launched. It is run as a child process under explorer.exe (as shown in Sysinternals Process Explorer), and it appears at Windows login.

I can't find this program in autoruns (by Sysinternals), it doesn't appear to be a driver, service, or listed in scheduled tasks. It is listed in the registry in 2 places, but not in a way that would cause it to run automatically as far as I can tell.

I even checked win.ini and system.ini, nothing.

How is this program launched? I like to understand Windows to the level of knowing what and why programs are running and where they come from.

I think this is the first time I have not been able to determine the launch mechanism for a program. About all I can guess at this point is that it is somehow integrated into Windows Explorer desktop, but I don't see how this is being set up.

share|improve this question
up vote 3 down vote accepted

On Adobe Forums:

As someone mentioned, it is the plugin module (NPSWF32.DLL in case of Netscale/Mozilla/Opera plugin) that does the check; thing is, it does not prompt the user to update immediately (it would not be able to do so with the browser open and the DLL in use anyway), but rather it defers the update until the next restart -- by adding a registry entry in the HKLM (or HKCU, not positive)\Software\Microsoft\Windows\CurrentVersion\RunOnce key. [...]

– Pa3PyX

(RunOnce items are removed automatically by Explorer.)

share|improve this answer
I am liking this answer -- I did not think of this. – P a u l Apr 6 '11 at 17:27
@Paul: Running Autoruns as administrator should allow you to find the entry. – Tom Wijsman Apr 7 '11 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .