Flash Player Automatic Updater on Windows Startup

Question

Adobe Flash Player is set to automatically check for updates on Windows startup. I've always wondered where exactly it is set to do this. Checking the running services, as well as msconfig does not yield its location. The message in question looks like this: http://www.technipages.com/disable-an-update-to-your-adobe-flash-player-is-available-message-forever.html

I know how to disable it via Adobe's web site (instructions are included in link above), but I'm interested in knowing where exactly in Windows is this set to perform this action? I have done some research on this, and people keep saying to check the following registry locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce or the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

However, I have checked those locations, and I still cannot locate where this updater is stored.

I'm pretty sure that malware also uses this technique to automatically load upon startup, and since it's not in the typical location(s) that a user would look, it's well hidden.

Answer 1

Exact answer is here. http://forums.adobe.com/thread/750559

This one was an entertaining puzzle, it's probably been answered elsewhere but I thought I'd let curious people know. As someone mentioned, it is the plugin module (NPSWF32.DLL in case of Netscape/Mozilla/Opera plugin) that does the check; thing is, it does not prompt the user to update immediately (it would not be able to do so with the browser open and the DLL in use anyway), but rather it defers the update until the next restart -- by adding a registry entry in HKLM (or HKCU, not positive)\Software\Microsoft\Windows\CurrentVersion\RunOnce key.

The entry is named FlashPlayerUpdate and contains <system root>\System32\Macromed\Flash\FlashUtil<version>_Plugin.exe -update plugin -- presumably the same command line you would run if you wanted to update the player manually (without the hassle with opening and closing your web browsers). The reason you don't see it in registry or with system tools like msconfig.exe is that RunOnce autostart entries are deleted from registry immediately once they are executed. Normally such entries are used by driver and Windows installations to perform one-time initialization after a reboot (once the required services are started and drivers loaded). So you would have seen that entry with msconfig, had you looked at it after the update check (which the plugin does silently), but before the reboot!

Answer 2

http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager05.html#118377

it's a setting within the flash player itself, which can be accessed in a roundabout way at that URL, which I found under the How do I change how often I receive notifications of updates? header of another link, but apparently as a new user I can't post more than one URL in an answer (because new users only use the internet one link at a time, I guess?)

Answer 3

The updater deletes the reg key for running on startup once it loads. See http://www.adobe.com/support/documentation/en/flashplayer/8/releasenotes.html

Answer 4

As an aside....

I'm pretty sure that malware also uses this technique to automatically load upon startup, and since it's not in the typical location(s) that a user would look, it's well hidden.

While users seldom look here, this is not what a developer or systems administrator would consider a "hidden" location. It is one of the most commonly used methods to run a program at login or startup, and the only method to explicitly start a program only once.

If you look at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run keys, I'll wager you have at least a dozen programs listed there already. It's standard practice. It's certainly no less obscure than C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

Answer 5

I have disabled the services and also readjusted a number of other update services and it was a huge boost for my laptop's performance. You can do that in Task Scheduler (you can find it via Control Panel->Administrative Tools->Task Scheduler).