Silent background update: old file(s) left behind

Report · May 04, 2012

On one of our systems, Japanese Windows XP Pro, I noticed that after the 11.2.292.235 update, file Flash32_11_2_202_233.ocx was left behind. Here is the FlashInstall.log file for that portion

2012-5-4+23-10-8.265 [error] 1226 1062
=O====== M/11.2.202.235 2012-05-04+23-10-02.421 ========
0000  00000010 FlashPlayerInstaller.exe -install -iv 9
0001  00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0002  00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0003  00000018
0004  00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0005  00000013 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
0006  00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
0007  00000016 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
0008  00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0009  00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183
0010  00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183
0011  00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
0012  00001106
0013  00001106
0014  00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183
0015  00000012
=X====== M/11.2.202.235 2012-05-04+23-10-08.281 ========

I thought that a Windows restart may clear that file, but it did not.

How is the background updater handling this; attempt to delete it at a later stage (e.g. during the next update)?

P.S. on all other systems, all files were successfully removed.

Report · May 06, 2012

On another system, English Windows XP Pro, I noticed that NPSWF32_11_2_202_233.dll was left behind. The log:

2012-5-5+2-23-8.625 [error] 1226 1062

=O====== M/11.2.202.235 2012-05-05+02-23-06.656 ========

0000 00000010 FlashPlayerInstaller.exe -install -iv 9

0001 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

0002 00001036 Software\Mozilla\Firefox\extensions/Plugins 2

0003 00001036 Software\Mozilla\MaintenanceService\extensions/Plugins 2

0004 00001036 Software\Mozilla\Mozilla Firefox\extensions/Plugins 2

0005 00001036 Software\Opera Software/Last CommandLine 2

0006 00001036 Software\Opera Software/Last CommandLine 2

0007 00001036 Software\Opera Software/Plugin Path 2

0008 00001036 Software\Opera Software/Plugin Path 2

0009 00001015 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll 5

0010 00000014 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

0011 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe

0012 00000017 C:\WINDOWS\system32\Macromed\Flash

0013 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

0014 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183

0015 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183

0016 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

0017 00001106

0018 00001106

0019 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183

0020 00000012

=X====== M/11.2.202.235 2012-05-05+02-23-08.671 ========

Report · May 07, 2012

Hi Pat,

Just before I dive into more detail: With each upgrade, we attempt to remove all old files from the system. This includes the ActiveX or Plugin control that you mention. Now, as you noticed, there are situations when an old file cannot be removed. This is usually due to a browser having the old Flash Player loaded in memory. In this case, we tell the OS to remove this old file upon reboot, which is the best option available. Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted. A reboot of the system will ultimately remove any old files that couldn’t be removed previously.

If the file is not removed after a reboot, you may have a permissions problem on the file or directory. Note that your browser will use the latest and safest version of Flash Player. Further updates will try again to remove this old file, but may not be able to do so if permissions have changed such that the installer cannot remove it.

Hope this helps.

-Stephen

Report · May 07, 2012

Hi Stephen,

Thank you very much for your detailed explanation. I will observe these left-behind files, and check how it goes with the next background update.

From your explanation I gather that these OCX and DLL files have been unregistered, so I can assume that it is safe for users to manually delete them without having to unregister them first. Is this correct?

Report · May 07, 2012

Hi Pat,

You're correct. These files can safely be removed by manually deleting them.

-Stephen

Report · May 08, 2012

Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted

This is actually not true in the case of the plugin for Firefox. If both the 233 and the 235 DLLs are left behind, Firefox continues to use the 233 DLL even after Firefox is restarted several times. This was true of most machines across our enterprise, as well as several computers at home. The solution is to manually delete the 233 version of the DLL. Then Firefox properly loads the 235 version the next time you run it.

Report · May 10, 2012

Hi dsmtoday2,

Thank you for your report and I've passed that along.

Is there any way that you could tell us if this only affects Firefox on these systems, or if other NPAPI browsers run into the same problem (such as Safari or Opera)?

Thank you,

Stephen

Report · May 10, 2012

Sorry, we only run Firefox, Chrome, and IE here, so I can't attest to what happens on those other browsers.

The only other thing I can add is that this was the 32bit version of Flash.

This is extremely easy to replicate. I went into the

c:\windows\system32\macromed\flash

directory and copied NPSWF32_11_2_202_235.dll to NPSWF32_11_2_202_233.dll

I then launched ProcMon from SysInternals so I could spy on exactly what was happening. Then I launched Firefox and went to the adobe flash about page. Of course, it returned version 235. But ProcMon told a different story. Firefox had launched the plugin-container.exe using the 233 DLL I just copied!

"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=2500.56b6a60.744882939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 2500 "\\.\pipe\gecko-crash-server-pipe.2500" plugin

The problem comes because Firefox is using a QueryDirectory command with '*' when it looks in the Macromed\Flash directory for the DLL. This returns items alphabetically. It must be looking for the NPSWF32 prefix, so the LOWEST version number will always win!

To prove this, I made a copy of NPSWF32_11_2_202_235.dll and named it NPSWF32_0.dll. So now I'm looking at the following directory entries.

FlashInstall.log

flashplayer.xpt

FlashPlayerUpdateService.exe

FlashUtil32_11_2_202_235_Plugin.exe

mms.cfg

NPSWF32_0.dll

NPSWF32_11_2_202_235.dll

Note that alphabetically, my _0 copy is above the real copy. I use ProcMon to spy on Firefox once again. And Firefox goes and loads NPSW32_0.dll into the plugin-container.exe command line! This is despite the registry having no mention of this file, and all registry entries that refer to flash have NPSWF32_11_2_202_235.dll in them.

You guys have a huge problem here.

Get ProcMon -> http://technet.microsoft.com/en-us/sysinternals/bb896645

Report · May 11, 2012

Hi,

Thanks for the follow up. This appears to be specific to Mozilla Firefox and we'll be reaching out to Mozilla.

Thanks again!

-Stephen