Question

How does Adobe Flash launch auto-update message as soon as I logon on Windows? I thought Flash is only a browser plugin. I tried look for the program it runs, but can’t find it in all the usual places: Start Up group in Start Menu, HKLM Run, HKCU Run, Services.

I know it is possible to disable this via Flash preferences. However, I need to remove it mechanically once and for all, because it seems like a security risk to me (as hackers would be able to exploit a Flash installation even if the browser has not been launched).

Answer 1

Exact answer is here. http://forums.adobe.com/thread/750559

This one was an entertaining puzzle, 
it's probably been answered elsewhere 
but I thought I'd let curious people know. 
As someone mentioned, it is the plugin module 
(NPSWF32.DLL in case of Netscale/Mozilla/Opera plugin) 
that does the check; thing is, 
it does not prompt the user to update immediately 
(it would not be able to do so with the browser open and the DLL in use anyway), 
but rather it defers the update until the next restart -- 
by adding a registry entry in the HKLM 
(or HKCU, not positive)\Software\Microsoft\Windows\CurrentVersion\RunOnce key. 
The entry is named FlashPlayerUpdate and contains 
\System32\Macromed\Flash\FlashUtil_Plugin.exe
-update plugin -- presumably the same command line 
you would run if you wanted to update the player manually 
(without the hassle with opening and closing your web browsers).

The reason you don't see it in registry or with system tools 
like msconfig.exe is that RunOnce autostart entries are deleted 
from registry immediately once they are executed. 
Normally such entries are used by driver and Windows installations 
to perform one-time initialization after a reboot 
(once the required services are started and drivers loaded). 
So you would have seen that entry with msconfig, 
had you looked at it after the update check 
(which the plugin does silently), but before the reboot!