3

About once a week this program is being run automatically:

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10n_Plugin10n_Plugin.exe

I know what it is, and what the updates are, I don't care about that. What I would like to know is how this program is being launched. It is run as a child process under explorer.exe (as shown in Sysinternals Process Explorer), and it appears at Windows login.

I can't find this program in autoruns (by Sysinternals), it doesn't appear to be a driver, service, or listed in scheduled tasks. It is listed in the registry in 2 places, but not in a way that would cause it to run automatically as far as I can tell.

I even checked win.ini and system.ini, nothing.

How is this program launched? I like to understand Windows to the level of knowing what and why programs are running and where they come from.

I think this is the first time I have not been able to determine the launch mechanism for a program. About all I can guess at this point is that it is somehow integrated into Windows Explorer desktop, but I don't see how this is being set up.

Tamara Wijsman
  • 57,881
P a u l
  • 1,355

1 Answers1

3

On Adobe Forums:

As someone mentioned, it is the plugin module (NPSWF32.DLL in case of Netscale/Mozilla/Opera plugin) that does the check; thing is, it does not prompt the user to update immediately (it would not be able to do so with the browser open and the DLL in use anyway), but rather it defers the update until the next restart -- by adding a registry entry in the HKLM (or HKCU, not positive)\Software\Microsoft\Windows\CurrentVersion\RunOnce key. [...]

– Pa3PyX

(RunOnce items are removed automatically by Explorer.)

grawity
  • 501,077