0

I've noticed some leftover registry keys from Adobe Flash although I removed it months ago:

HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia

I tried to delete them but I didn't have the necessary permissions so I made sure regedit.exe was running with admin privileges but it still wasn't possible. So I did some research and found this tutorial to take ownership of registry keys but the deletion still didn't work! After that I used runassystem.exe to open regedit.exe as SYSTEM but again the same error! And after that I tried to give the full ownership as SYSTEM to my user account and all Administrators... same error!

Well, then I searched my whole C: drive and found two folders:

C:\WINDOWS\System32\Macromed\Flash
C:\WINDOWS\SysWOW64\Macromed\Flash

Both of them contain exactly the same files:

enter image description here

I tried to delete them as admin... didn't work! Not even with Lockhunter!

enter image description here

Lockhunter says there's no process blocking these folders so I tried to delete them but yet again... it didn't work! So I clicked "delete at next system restart" and rebooted. At log on it prompts that the deletion was successful but guess what? The folders are still there!

What the hell is this? In what world is such a behavior acceptable from a "legitimate" company? How to delete Flash completely?

  • Have you tried using Autoruns to check if any of these programs are loading on start up? – BillDOe Aug 11 '17 at 18:52
  • Yes, I've searched for every file individually via filter but none of them were found. I also tried to open the files with Ctrl + O but it only says "The file is corrupt". – Clacers Aug 12 '17 at 8:38
2
  • Delete the flash system files by running these commands in a batch file::

    for %%X in (
    "%SystemRoot%\System32\Macromed"
    "%SystemRoot%\SysWOW64\Macromed") do (
     takeown /F %%X /R /D Y
     icacls %%X /grant Everyone:F /T
     rd /S /Q %%X
     )
    

    Explanation: In this for command, it takes the two folder paths in it's %%X variable. Then takeown takes ownership of the two folders recursively without any prompt and icacls grants all rights for everyone user. rd command removes the directory recursively and quietly.

  • Delete the registry, first download SetAcl commandline tool and run these commands in a batch file::

    for %%X in (
    "HKLM\SOFTWARE\Macromedia"
    "HKLM\SOFTWARE\WOW6432Node\Macromedia") do (
    SetACL.exe -on %%X -ot reg -rec cont_obj -actn setowner -ownr "n:Everyone"
    SetACL.exe -on %%X -ot reg -rec cont_obj -actn ace -ace "n:Everyone;p:full"
    reg delete %%X /F
    )
    

    Explanation: As before for command passes the registry keys to SetACL.exe executable command. Here the Object name (-on) is the registry path, Object type (-ot) is registry, Action (-actn) is to set owner, and the owner should be Everyone. -rec is to continue as recursively. -actn ace -ace adds or modifies access control entries (ACEs). Multiple ACEs may be specified like that.

See the SetACL command in action::

SetACL command in action

Further reading::

Edit:: You may run these commands from command prompt. To do so use %X instead of %%X. Also if you see any permission error, then change the Everyone user to Administrator or to your user name. Like in icacls command use as:: icacls %%X /grant John:F /T if John is your user account name.

-1

It din't work for me with Win 10 LTSB. So I've used the registry editor from the free bootable iso KRD18 from kapersky (use rufus to make your bootable flashdrive), but before use it you have to shut down all stuff that can made win 10 to update, desactivate the update service, and then use "StopUpdates10", it is faster than delete "EOSNOTIFY.EXE, UsoClient.exe, MusNotification.exe, UpdateAssistant.exe, WINDOWS10UPGRADERAPP.EXE, remsh.exe, dismHost.exe, SIHClient.exe, InstallAgent.exe, Windows10Upgrade.exe, WaaSMedic.exe" with the file explorer of KRD18. If you don't do this Win 10 will "update" >>> in fact reinstall flashplayer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.