Skip navigation
Currently Being Moderated

Silent background update: old file(s) left behind

May 4, 2012 11:17 PM

On one of our systems, Japanese Windows XP Pro, I noticed that after the update, file Flash32_11_2_202_233.ocx was left behind.  Here is the FlashInstall.log file for that portion


2012-5-4+23-10-8.265 [error] 1226 1062
=O====== M/ 2012-05-04+23-10-02.421 ========
0000 [I] 00000010 FlashPlayerInstaller.exe -install -iv 9
0001 [I] 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0002 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0003 [I] 00000018
0004 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0005 [I] 00000013 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
0006 [I] 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
0007 [I] 00000016 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
0008 [I] 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0009 [W] 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183
0010 [W] 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183
0011 [I] 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
0012 [W] 00001106
0013 [W] 00001106
0014 [W] 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183
0015 [I] 00000012
=X====== M/ 2012-05-04+23-10-08.281 ========


I thought that a Windows restart may clear that file, but it did not.


How is the background updater handling this; attempt to delete it at a later stage (e.g. during the next update)?


P.S. on all other systems, all files were successfully removed.

  • Currently Being Moderated
    May 7, 2012 3:21 PM   in reply to Pat Willener

    Hi Pat,


    Just before I dive into more detail: With each upgrade, we attempt to remove all old files from the system. This includes the ActiveX or Plugin control that you mention. Now, as you noticed, there are situations when an old file cannot be removed. This is usually due to a browser having the old Flash Player loaded in memory. In this case, we tell the OS to remove this old file upon reboot, which is the best option available. Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted. A reboot of the system will ultimately remove any old files that couldn’t be removed previously.


    If the file is not removed after a reboot, you may have a permissions problem on the file or directory. Note that your browser will use the latest and safest version of Flash Player. Further updates will try again to remove this old file, but may not be able to do so if permissions have changed such that the installer cannot remove it.


    Hope this helps.



    Mark as:
  • Currently Being Moderated
    May 7, 2012 8:01 PM   in reply to Pat Willener

    Hi Pat,


    You're correct. These files can safely be removed by manually deleting them.



    Mark as:
  • Currently Being Moderated
    May 8, 2012 12:49 AM   in reply to Stephen Pohl

    Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted


    This is actually not true in the case of the plugin for Firefox.  If both the 233 and the 235 DLLs are left behind, Firefox continues to use the 233 DLL even after Firefox is restarted several times.  This was true of most machines across our enterprise, as well as several computers at home.  The solution is to manually delete the 233 version of the DLL.  Then Firefox properly loads the 235 version the next time you run it.

    Mark as:
  • Currently Being Moderated
    May 10, 2012 10:15 AM   in reply to dsmtoday2

    Hi dsmtoday2,


    Thank you for your report and I've passed that along.


    Is there any way that you could tell us if this only affects Firefox on these systems, or if other NPAPI browsers run into the same problem (such as Safari or Opera)?


    Thank you,


    Mark as:
  • Currently Being Moderated
    May 10, 2012 11:01 PM   in reply to Stephen Pohl

    Sorry, we only run Firefox, Chrome, and IE here, so I can't attest to what happens on those other browsers.


    The only other thing I can add is that this was the 32bit version of Flash.


    This is extremely easy to replicate.  I went into the


    directory and copied NPSWF32_11_2_202_235.dll to NPSWF32_11_2_202_233.dll


    I then launched ProcMon from SysInternals so I could spy on exactly what was happening.  Then I launched Firefox and went to the adobe flash about page.  Of course, it returned version 235.  But ProcMon told a different story.  Firefox had launched the plugin-container.exe using the 233 DLL I just copied!

    "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=2500.56b6a60.744882939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 2500 "\\.\pipe\gecko-crash-server-pipe.2500" plugin


    The problem comes because Firefox is using a QueryDirectory command with '*' when it looks in the Macromed\Flash directory for the DLL.  This returns items alphabetically.  It must be looking for the NPSWF32 prefix, so the LOWEST version number will always win!


    To prove this, I made a copy of NPSWF32_11_2_202_235.dll and named it NPSWF32_0.dll.  So now I'm looking at the following directory entries.










    Note that alphabetically, my _0 copy is above the real copy.  I use ProcMon to spy on Firefox once again.  And Firefox goes and loads NPSW32_0.dll into the plugin-container.exe command line!  This is despite the registry having no mention of this file, and all registry entries that refer to flash have NPSWF32_11_2_202_235.dll in them.


    You guys have a huge problem here.


    Get ProcMon ->

    Mark as:
  • Currently Being Moderated
    May 11, 2012 10:00 AM   in reply to dsmtoday2



    Thanks for the follow up. This appears to be specific to Mozilla Firefox and we'll be reaching out to Mozilla.


    Thanks again!



    Mark as:

More Like This

  • Retrieving data ...

Bookmarked By (0)

Answers + Points = Status

  • 10 points awarded for Correct Answers
  • 5 points awarded for Helpful Answers
  • 10,000+ points
  • 1,001-10,000 points
  • 501-1,000 points
  • 5-500 points