Skip to main content
Participating Frequently
May 1, 2011
Question

Flash Player with IE8 problems

  • May 1, 2011
  • 4 replies
  • 3603 views

I have Vista 64 bit and   McAfee security suite.  The system came with IE8, and has been running Flash  Player

until Tuesday.  Now I get  the white box with the little red x.  It says I don't have FP and should  download it.

Also, embedded pictures in  e-mail do the same.

When I started IE, my  homepage is yahoo, a box appeared that said 'A problem occurred, the page would  restart'.

When I clicked ok, a file  started to download and ran a setup program.  McAfee normally asks if I want to  allow this,

but not this time.  It  created a folder in Program Files X86\e-set.  The scan started id'ing everything  as a threat and

I should click on 'fix'.  I  couldn't kill the program,  I couldn't delete the .exe.  I was able to rename  it, but when I tried

to soft boot the scan id'd  taskmgr as a threat.  I cycled power and the scan didn't restart.

I found a malware scan on  MS support and downloaded and ran it.  It also removed a file named Rogue  fakesystem32.

That's when I started to  have these problems.

I can't remember the name  of the bad scan, but it said it was created by Heavenstools.

I downloaded a beta version  of 64 bit FP, but after reading this board, I checked and it was in SYS32 and  not in

SYSWOW64.  I copied them  over.

The MS scanner removed the the problem software.  Everything else works, I'm

using the PC now.  FP works in FF and Google browsers.

I can't run any player on IE, Youtube, EBAUMSWORLD, newspaper crosswords

etc.

McAfee did nothing on the malware.  I ran a quick scan AND a scan on the

e-set folder itself.  I can't remember how or where I found the MS scan.  It

was on MS/support.

I've tried getting into Adobe on the other browsers too.

Les H

    This topic has been closed for replies.

    4 replies

    May 2, 2011

    Hi Les, When you want to reply to your thread it is better to look in your email notification and click on "visit the message page". This will bring you directly to the Flash Player Forum and the message that I or anyone else has replied to. Also any links within the message page here should be used and not any links within the email notification. There is a problem between the links in the email notification and the format of the Flash Player Forum.

    Replying as I've stated above also doesn't post my message to you again.

    Now, please refer to my message in Post#1 to you. When you go here: Go to C:\Windows\System32\Macromed\Flash 

    Just right click on that Flash folder. There are several listings of files there. I don't need the info in any Install logs or any Text files. I just need to know what is listed there, i.e. Flash10p.ocx, etc.

    Then Go to C:\Windows\SysWOW64\Macromed\Flash  And do the same thing as in the location of the System32. I need the same information as above.

    There will be 3 Files listed in the System32 location PLUS 3 of the NPSWF files. Follow my instructions in Post#1, and the same thing for the SysWOW64 location.

    This: Using IE8, go to Tools>Manage addons under "Show"(very light text) look in

    all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If

    so what Flash Player version is it?

    Once you find "Show" there are 4 categories there. All addons, run without permission, currently loaded, etc. That is where the Shockwave Flash Object is listed, not in the Toolbars & Extension location.

    Once we get the above information taken care of, then we can proceed.

    Thanks,

    eidnolb

    lesharcleAuthor
    Participating Frequently
    May 2, 2011

    The responses are in post 8, after each topic.

    May 2, 2011

    Hi Les, It appears that you want to give me information that you think I need instead of what I requested. What I asked for should have taken my request to you and your reply back. 2 messages. Instead we have had 10 message and still what I've asked for has not been supplied.

    Until you supply the information I requested, I can't help you.

    Take a look at this thread to see how easy it is: http://forums.adobe.com/thread/846207?tstart=0 Post# 3 &#4.

    eidnolb

    lesharcleAuthor
    Participating Frequently
    May 2, 2011

    *Go to C:\Windows\System32\Macromed\Flash Open Flash and post back all files


    listed there. The NPSWF files you'll need to right click on and then click


    on Properties to obtain the version numbers.*

      

    FlashInstall  4/30/11  text file


    *While you are there, replace "System32" with SysWOW64 and post back the


    files listed there.*

        Do you mean all of System32 or just \Adobe  and \Macromed?


        Contents of SYSWOW64:
          \Adobe
             \Director
                  M5drvr                app
                  M5if32.dll           app ext
                  MP32dsw.dll       app ext
                  SwDir.dll             app ext

                 SWDNLD            app
             \Shockwave11
                  \Xtras
                        autodownload     text
                        CBrowser            x32
                        INetURL             x32
                        Multiusr              x32
                        Netfile                 x32
                        Netlingo              x32
                        Speech                x32
                 Control.dll            app ext
                 dirapi.dll               app ext
                 DynaPlayer.dll      app ext
                 gi.dll                      app ext
                 gt                           app
                 gtapi.dll                 app ext
                 Iml32.dll                app ext
                 Plugin.dll               app ext
                 Proj.dll                   app ext
                 Shockwave_Projector_Loader     DCR file
                 SWHelper_1150600    app
                 SWInit                         app
                 SWLogo                      bitmap
                 SWMenu.dll                app ext
                 uninstaller                    app

    *Using IE8, go to Tools>Manage addons under "Show"(very light text) look in


    all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If


    so what Flash Player version is it?*

         

    No.  In Toolbars Extensions there is Adobe PDF Link Helper   ver
    10.0.1.434

    *That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder


    still in Program files X86\e-set?*

                  No.

    *After you obtain the above information for me, go to


    http://www.malwarebytes.org

    and download and SAVE this to your Desktop.*


    *Click on the Update feature and allow it to update. Then close it.*

             Waiting for your answer about replacing Sys32.

    *Next, close all browser windows. Disable McAfee this way:*

    Participant
    May 1, 2011

    Try running a scan with Microsoft Security Essentials and then remove the corrupt add-on completely and allow Adobe's website to reinstall it for you.

    Kind regards

    Mike


    Message was edited by Jochem van Dieten

    May 1, 2011

    Hi holzeee, Which addon are you referring to? Are you speaking of Adobe Flash Player, since you said to allow the Adobe website to re-install it?

    Just trying to understand your suggestion.

    Thanks,

    eidnolb

    lesharcleAuthor
    Participating Frequently
    May 1, 2011

    It appears (to me) that the downloader is only sending the 64 bit files to

    SYSWOW64, since there are no files in SYS31.

    May 1, 2011

    Hi les, thanks for starting your thread. I have a few questions and need some information.

    Go to C:\Windows\System32\Macromed\Flash  Open Flash and post back all files listed there. The NPSWF files you'll need to right click on and then click on Properties to obtain the version numbers.

    While you are there, replace "System32" with SysWOW64 and post back the files listed there.

    Using IE8, go to Tools>Manage addons under "Show"(very light text) look in all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If so what Flash Player version is it?

    That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder still in Program files X86\e-set?

    After you obtain the above information for me, go to www.malwarebytes.org and download and SAVE this to your Desktop.

    Click on the Update feature and allow it to update. Then close it.

    Next, close all browser windows. Disable McAfee this way:

    RE: security suite disable
    Double-click the taskbar icon to open Security Center
    Click Advanced Menu (bottom left)
    Click Configure (left)
    Click Computer & Files (top left)

    You can disable VirusScan in the riught-hand module and tell it for how long.

    Then Open MBAM(malwarebytes) and run a full scan. This may take 30-45 minutes. If anything is found, follow their instructions for removing.

    Send me the info prior to MBAM etc.

    Thanks,

    eidnolb

    lesharcleAuthor
    Participating Frequently
    May 1, 2011