Skip to main content
pwillener
pwillener
Brainiac
May 5, 2012
Question

Silent background update: old file(s) left behind

  • May 5, 2012
  • 1 reply
  • 9649 views

On one of our systems, Japanese Windows XP Pro, I noticed that after the 11.2.292.235 update, file Flash32_11_2_202_233.ocx was left behind.  Here is the FlashInstall.log file for that portion

2012-5-4+23-10-8.265 [error] 1226 1062
=O====== M/11.2.202.235 2012-05-04+23-10-02.421 ========
0000  00000010 FlashPlayerInstaller.exe -install -iv 9
0001  00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0002  00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0003  00000018
0004  00001015 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_233.ocx 20
0005  00000013 C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
0006  00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
0007  00000016 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
0008  00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
0009  00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183
0010  00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183
0011  00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
0012  00001106
0013  00001106
0014  00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183
0015  00000012
=X====== M/11.2.202.235 2012-05-04+23-10-08.281 ========

I thought that a Windows restart may clear that file, but it did not.

How is the background updater handling this; attempt to delete it at a later stage (e.g. during the next update)?

P.S. on all other systems, all files were successfully removed.

This topic has been closed for replies.

1 reply

pwillener
pwillenerAuthor
Brainiac
May 7, 2012

On another system, English Windows XP Pro, I noticed that NPSWF32_11_2_202_233.dll was left behind. The log:

2012-5-5+2-23-8.625 [error] 1226 1062

=O====== M/11.2.202.235 2012-05-05+02-23-06.656 ========

0000 00000010 FlashPlayerInstaller.exe -install -iv 9

0001 00000020 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

0002 00001036 Software\Mozilla\Firefox\extensions/Plugins 2

0003 00001036 Software\Mozilla\MaintenanceService\extensions/Plugins 2

0004 00001036 Software\Mozilla\Mozilla Firefox\extensions/Plugins 2

0005 00001036 Software\Opera Software/Last CommandLine 2

0006 00001036 Software\Opera Software/Last CommandLine 2

0007 00001036 Software\Opera Software/Plugin Path 2

0008 00001036 Software\Opera Software/Plugin Path 2

0009 00001015 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll 5

0010 00000014 C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

0011 00000015 C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe

0012 00000017 C:\WINDOWS\system32\Macromed\Flash

0013 00000019 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

0014 00001024 C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 183

0015 00001024 C:\WINDOWS\system32\FlashPlayerApp.exe 183

0016 00000021 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

0017 00001106

0018 00001106

0019 00001024 C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 183

0020 00000012

=X====== M/11.2.202.235 2012-05-05+02-23-08.671 ========

A
Anonymous
May 7, 2012

Hi Pat,

Just before I dive into more detail: With each upgrade, we attempt to remove all old files from the system. This includes the ActiveX or Plugin control that you mention. Now, as you noticed, there are situations when an old file cannot be removed. This is usually due to a browser having the old Flash Player loaded in memory. In this case, we tell the OS to remove this old file upon reboot, which is the best option available. Since the registry doesn’t reference the old Flash Player anymore, new browser instances will load the new Flash Player even before a system is rebooted. A reboot of the system will ultimately remove any old files that couldn’t be removed previously.

If the file is not removed after a reboot, you may have a permissions problem on the file or directory. Note that your browser will use the latest and safest version of Flash Player. Further updates will try again to remove this old file, but may not be able to do so if permissions have changed such that the installer cannot remove it.

Hope this helps.

-Stephen

A
Anonymous
May 11, 2012

Hi dsmtoday2,

Thank you for your report and I've passed that along.

Is there any way that you could tell us if this only affects Firefox on these systems, or if other NPAPI browsers run into the same problem (such as Safari or Opera)?

Thank you,

Stephen


Sorry, we only run Firefox, Chrome, and IE here, so I can't attest to what happens on those other browsers.

The only other thing I can add is that this was the 32bit version of Flash.

This is extremely easy to replicate.  I went into the

c:\windows\system32\macromed\flash

directory and copied NPSWF32_11_2_202_235.dll to NPSWF32_11_2_202_233.dll

I then launched ProcMon from SysInternals so I could spy on exactly what was happening.  Then I launched Firefox and went to the adobe flash about page.  Of course, it returned version 235.  But ProcMon told a different story.  Firefox had launched the plugin-container.exe using the 233 DLL I just copied!

"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=2500.56b6a60.744882939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll" - -greomni "C:\Program Files\Mozilla Firefox\omni.ja" 2500 "\\.\pipe\gecko-crash-server-pipe.2500" plugin

The problem comes because Firefox is using a QueryDirectory command with '*' when it looks in the Macromed\Flash directory for the DLL.  This returns items alphabetically.  It must be looking for the NPSWF32 prefix, so the LOWEST version number will always win!

To prove this, I made a copy of NPSWF32_11_2_202_235.dll and named it NPSWF32_0.dll.  So now I'm looking at the following directory entries.

FlashInstall.log

flashplayer.xpt

FlashPlayerUpdateService.exe

FlashUtil32_11_2_202_235_Plugin.exe

mms.cfg

NPSWF32_0.dll

NPSWF32_11_2_202_235.dll

Note that alphabetically, my _0 copy is above the real copy.  I use ProcMon to spy on Firefox once again.  And Firefox goes and loads NPSW32_0.dll into the plugin-container.exe command line!  This is despite the registry having no mention of this file, and all registry entries that refer to flash have NPSWF32_11_2_202_235.dll in them.

You guys have a huge problem here.

Get ProcMon -> http://technet.microsoft.com/en-us/sysinternals/bb896645

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices