8 Replies Latest reply: May 11, 2012 10:00 AM by Stephen Pohl RSS

    Silent background update: old file(s) left behind

    pwillener ACP/MVPs

      On one of our systems, Japanese Windows XP Pro, I noticed that after the 11.2.292.235 update, file Flash32_11_2_202_233.ocx was left behind.  Here is the FlashInstall.log file for that portion

       

      2012-5-4+23-10-8.265 [error] 1226 1062
      =O====== M/11.2.202.235 2012-05-04+23-10-02.421 ========
      0000 [I] 00000010 FlashPlayerInstaller.exe -install -iv 9
      0001 [I] 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
      0002 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
      0003 [I] 00000018
      0004 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
      0005 [I] 00000013 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
      0006 [I] 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
      0007 [I] 00000016 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
      0008 [I] 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
      0009 [W] 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183
      0010 [W] 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183
      0011 [I] 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
      0012 [W] 00001106
      0013 [W] 00001106
      0014 [W] 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183
      0015 [I] 00000012
      =X====== M/11.2.202.235 2012-05-04+23-10-08.281 ========
      

       

      I thought that a Windows restart may clear that file, but it did not.

       

      How is the background updater handling this; attempt to delete it at a later stage (e.g. during the next update)?

       

      P.S. on all other systems, all files were successfully removed.

        • 1. Re: Silent background update: old file(s) left behind
          pwillener ACP/MVPs

          On another system, English Windows XP Pro, I noticed that NPSWF32_11_2_202_233.dll was left behind. The log:

          2012-5-5+2-23-8.625 [error] 1226 1062

          =O====== M/11.2.202.235 2012-05-05+02-23-06.656 ========

          0000 [I] 00000010 FlashPlayerInstaller.exe -install -iv 9

          0001 [I] 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

          0002 [W] 00001036 Software\Mozilla\Firefox\extensions/Plugins 2

          0003 [W] 00001036 Software\Mozilla\MaintenanceService\extensions/Plugins 2

          0004 [W] 00001036 Software\Mozilla\Mozilla Firefox\extensions/Plugins 2

          0005 [W] 00001036 Software\Opera Software/Last CommandLine 2

          0006 [W] 00001036 Software\Opera Software/Last CommandLine 2

          0007 [W] 00001036 Software\Opera Software/Plugin Path 2

          0008 [W] 00001036 Software\Opera Software/Plugin Path 2

          0009 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll 5

          0010 [I] 00000014 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

          0011 [I] 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe

          0012 [I] 00000017 C:\WINDOWS\system32\Macromed\Flash

          0013 [I] 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

          0014 [W] 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183

          0015 [W] 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183

          0016 [I] 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

          0017 [W] 00001106

          0018 [W] 00001106

          0019 [W] 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183

          0020 [I] 00000012

          =X====== M/11.2.202.235 2012-05-05+02-23-08.671 ========

          • 2. Re: Silent background update: old file(s) left behind
            Stephen Pohl Community Member

            Hi Pat,

             

            Just before I dive into more detail: With each upgrade, we attempt to remove all old files from the system. This includes the ActiveX or Plugin control that you mention. Now, as you noticed, there are situations when an old file cannot be removed. This is usually due to a browser having the old Flash Player loaded in memory. In this case, we tell the OS to remove this old file upon reboot, which is the best option available. Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted. A reboot of the system will ultimately remove any old files that couldn’t be removed previously.

             

            If the file is not removed after a reboot, you may have a permissions problem on the file or directory. Note that your browser will use the latest and safest version of Flash Player. Further updates will try again to remove this old file, but may not be able to do so if permissions have changed such that the installer cannot remove it.

             

            Hope this helps.

             

            -Stephen

            • 3. Re: Silent background update: old file(s) left behind
              pwillener ACP/MVPs

              Hi Stephen,

               

              Thank you very much for your detailed explanation.  I will observe these left-behind files, and check how it goes with the next background update.

               

              From your explanation I gather that these OCX and DLL files have been unregistered, so I can assume that it is safe for users to manually delete them without having to unregister them first.  Is this correct?

              • 4. Re: Silent background update: old file(s) left behind
                Stephen Pohl Community Member

                Hi Pat,

                 

                You're correct. These files can safely be removed by manually deleting them.

                 

                -Stephen

                • 5. Re: Silent background update: old file(s) left behind
                  dsmtoday2

                  Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted

                   

                  This is actually not true in the case of the plugin for Firefox.  If both the 233 and the 235 DLLs are left behind, Firefox continues to use the 233 DLL even after Firefox is restarted several times.  This was true of most machines across our enterprise, as well as several computers at home.  The solution is to manually delete the 233 version of the DLL.  Then Firefox properly loads the 235 version the next time you run it.

                  • 6. Re: Silent background update: old file(s) left behind
                    Stephen Pohl Community Member

                    Hi dsmtoday2,

                     

                    Thank you for your report and I've passed that along.

                     

                    Is there any way that you could tell us if this only affects Firefox on these systems, or if other NPAPI browsers run into the same problem (such as Safari or Opera)?

                     

                    Thank you,

                    Stephen

                    • 7. Re: Silent background update: old file(s) left behind
                      dsmtoday2

                      Sorry, we only run Firefox, Chrome, and IE here, so I can't attest to what happens on those other browsers.

                       

                      The only other thing I can add is that this was the 32bit version of Flash.

                       

                      This is extremely easy to replicate.  I went into the

                      c:\windows\system32\macromed\flash

                      directory and copied NPSWF32_11_2_202_235.dll to NPSWF32_11_2_202_233.dll

                       

                      I then launched ProcMon from SysInternals so I could spy on exactly what was happening.  Then I launched Firefox and went to the adobe flash about page.  Of course, it returned version 235.  But ProcMon told a different story.  Firefox had launched the plugin-container.exe using the 233 DLL I just copied!

                      "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=2500.56b6a60.744882939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 2500 "\\.\pipe\gecko-crash-server-pipe.2500" plugin

                       

                      The problem comes because Firefox is using a QueryDirectory command with '*' when it looks in the Macromed\Flash directory for the DLL.  This returns items alphabetically.  It must be looking for the NPSWF32 prefix, so the LOWEST version number will always win!

                       

                      To prove this, I made a copy of NPSWF32_11_2_202_235.dll and named it NPSWF32_0.dll.  So now I'm looking at the following directory entries.

                       

                      FlashInstall.log

                      flashplayer.xpt

                      FlashPlayerUpdateService.exe

                      FlashUtil32_11_2_202_235_Plugin.exe

                      mms.cfg

                      NPSWF32_0.dll

                      NPSWF32_11_2_202_235.dll

                       

                      Note that alphabetically, my _0 copy is above the real copy.  I use ProcMon to spy on Firefox once again.  And Firefox goes and loads NPSW32_0.dll into the plugin-container.exe command line!  This is despite the registry having no mention of this file, and all registry entries that refer to flash have NPSWF32_11_2_202_235.dll in them.

                       

                      You guys have a huge problem here.

                       

                      Get ProcMon -> http://technet.microsoft.com/en-us/sysinternals/bb896645

                      • 8. Re: Silent background update: old file(s) left behind
                        Stephen Pohl Community Member

                        Hi,

                         

                        Thanks for the follow up. This appears to be specific to Mozilla Firefox and we'll be reaching out to Mozilla.

                         

                        Thanks again!

                         

                        -Stephen