On another system, English Windows XP Pro, I noticed that NPSWF32_11_2_202_233.dll was left behind. The log:
2012-5-5+2-23-8.625 [error] 1226 1062
=O====== M/22.214.171.124 2012-05-05+02-23-06.656 ========
0000 [I] 00000010 FlashPlayerInstaller.exe -install -iv 9
0001 [I] 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0002 [W] 00001036 Software\Mozilla\Firefox\extensions/Plugins 2
0003 [W] 00001036 Software\Mozilla\MaintenanceService\extensions/Plugins 2
0004 [W] 00001036 Software\Mozilla\Mozilla Firefox\extensions/Plugins 2
0005 [W] 00001036 Software\Opera Software/Last CommandLine 2
0006 [W] 00001036 Software\Opera Software/Last CommandLine 2
0007 [W] 00001036 Software\Opera Software/Plugin Path 2
0008 [W] 00001036 Software\Opera Software/Plugin Path 2
0009 [W] 00001015 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll 5
0010 [I] 00000014 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
0011 [I] 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe
0012 [I] 00000017 C:\WINDOWS\system32\Macromed\Flash
0013 [I] 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0014 [W] 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183
0015 [W] 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183
0016 [I] 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
0017 [W] 00001106
0018 [W] 00001106
0019 [W] 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183
0020 [I] 00000012
=X====== M/126.96.36.199 2012-05-05+02-23-08.671 ========
Just before I dive into more detail: With each upgrade, we attempt to remove all old files from the system. This includes the ActiveX or Plugin control that you mention. Now, as you noticed, there are situations when an old file cannot be removed. This is usually due to a browser having the old Flash Player loaded in memory. In this case, we tell the OS to remove this old file upon reboot, which is the best option available. Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted. A reboot of the system will ultimately remove any old files that couldn’t be removed previously.
If the file is not removed after a reboot, you may have a permissions problem on the file or directory. Note that your browser will use the latest and safest version of Flash Player. Further updates will try again to remove this old file, but may not be able to do so if permissions have changed such that the installer cannot remove it.
Hope this helps.
Thank you very much for your detailed explanation. I will observe these left-behind files, and check how it goes with the next background update.
From your explanation I gather that these OCX and DLL files have been unregistered, so I can assume that it is safe for users to manually delete them without having to unregister them first. Is this correct?
You're correct. These files can safely be removed by manually deleting them.
Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted
This is actually not true in the case of the plugin for Firefox. If both the 233 and the 235 DLLs are left behind, Firefox continues to use the 233 DLL even after Firefox is restarted several times. This was true of most machines across our enterprise, as well as several computers at home. The solution is to manually delete the 233 version of the DLL. Then Firefox properly loads the 235 version the next time you run it.
Thank you for your report and I've passed that along.
Is there any way that you could tell us if this only affects Firefox on these systems, or if other NPAPI browsers run into the same problem (such as Safari or Opera)?
Sorry, we only run Firefox, Chrome, and IE here, so I can't attest to what happens on those other browsers.
The only other thing I can add is that this was the 32bit version of Flash.
This is extremely easy to replicate. I went into the
directory and copied NPSWF32_11_2_202_235.dll to NPSWF32_11_2_202_233.dll
I then launched ProcMon from SysInternals so I could spy on exactly what was happening. Then I launched Firefox and went to the adobe flash about page. Of course, it returned version 235. But ProcMon told a different story. Firefox had launched the plugin-container.exe using the 233 DLL I just copied!
"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=2500.56b6a60.744882939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 2500 "\\.\pipe\gecko-crash-server-pipe.2500" plugin
The problem comes because Firefox is using a QueryDirectory command with '*' when it looks in the Macromed\Flash directory for the DLL. This returns items alphabetically. It must be looking for the NPSWF32 prefix, so the LOWEST version number will always win!
To prove this, I made a copy of NPSWF32_11_2_202_235.dll and named it NPSWF32_0.dll. So now I'm looking at the following directory entries.
Note that alphabetically, my _0 copy is above the real copy. I use ProcMon to spy on Firefox once again. And Firefox goes and loads NPSW32_0.dll into the plugin-container.exe command line! This is despite the registry having no mention of this file, and all registry entries that refer to flash have NPSWF32_11_2_202_235.dll in them.
You guys have a huge problem here.
Get ProcMon -> http://technet.microsoft.com/en-us/sysinternals/bb896645
Thanks for the follow up. This appears to be specific to Mozilla Firefox and we'll be reaching out to Mozilla.