Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Flash9f.ocx keeps reappearing

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Adobe Systems
And, this specific program:
Adobe Flash Player 9.x

This thread has been marked as locked.
ParzivalRM Flash9f.ocx keeps reappearing
Member 24th Oct, 2011 03:30
Ranking: 13
Posts: 41
User Since: 15th May, 2010
System Score: N/A
Location: AU
I am having a serious problem on my 64-bit Windows 7 laptop getting rid of
\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx
which Secunia declares is end-of-life and should go. The file was still there after updating to Adobe Flash 11.0.1.152 (IE and non-IE).

I uninstalled Flash using the programme "uninstall_flash_player_64bit.exe" from Adobe's website. Note that I shut down Secunia and prevented it restarting at boot for the duration of this exercise. I also shut down all other system tray icons at this point. Flash9f.ocx was gone.

On rebooting, Flash9f.ocx reappears, even without reinstall of updated Flash. I checked that there were no other instances of Flash9f.ocx on the computer, sp where did it come from?

I turned off the internet and repeated the exercise --- still Flash9f.ocx reappeared!

I deleted Flash9f.ocx. (On other occasions, I was not able to deleted the file.) Then I "rescanned the program" with Secunia, and Secunia claimed Flash9f.ocx was still there in the directory, though I could not see it (hidden and system files are turned on).

I rebooted, Flash9f.ocx reappeared, I deleted Flash9f.ocx again, installed the two updated Flash (IE and non-IE), and Flash9f.ocx reappeared. I deleted it, rescanned with Secunia, and again Secunia said that it was there, even though I couldn't see it.

* What's going on?
* Why doesn't Adobe's uninstall get rid of everything?
* Why is Flash9f.ocx coming back, and where on Earth is it coming back from?
* Why is Secunia reporting Flash9f.ocx is present in the directory when I cannot see it?
* Most importantly --- How do I get rid of Flash9f.ocx?

By the way, this problem did not occur on the three 32-bit Windows 7 computers that we have. All four computers are running Kaspersky PURE, and everything is fully updated.

Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 24th Oct, 2011 08:49
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Have U tried this method?

REMOVING OLD ADOBE (FORMERLY MACROMEDIA) OCX FILES.

If Flash was running when an update was attempted it will not remove all of the old (and vulnerable) files.

To remove these files:

COMPLETELY EXIT (using Task Manager if necessary):

a. All Browsers.
b. Windows Messenger.
c. Incredimail
d. All Adobe products
e. PSI unless using Version 2.

Now navigate to here:

32 Bit Systems - C:\Windows\system32\Macromed\Flash

64 Bit Systems - C:\Windows\sysWOW64\Macromed\Flash

Find & delete \Windows\SysWOW64\Macromed\Flash\Flash9f.ocx


Run a full PSI scan.

Update 12 00:10 07/10/2011








--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+3
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 24th Oct, 2011 10:10
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
Last edited on 24th Oct, 2011 10:10
Hey Maurice,

I believe @ParzivalRM has problems with some WOW64 magic.

However, 32-bit Flash worked without this side effect. @PazivalRM, are you sure you did not install 32-bit Flash player and attempt to remove with 64-bit uninstaller. WOW64 is in essence for 32-bit stuff on 64-bit MS Win, isn't it?

That about covers my ideas about solution.

Rgdz,
Marv


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 24th Oct, 2011 10:25
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Thanks for replying so quickly. No success, however, I'm afraid.

I had in fact done all this already, but I did it all again, with the extra step of first stopping the Adobe Reader service. Here are all the gory details. (To repeat, it is a 64-bit Windows 7 ASUS laptop with Kasperksy PURE, and everything is fully updated.)

1. I closed the Adobe Reader service using jv16 power tools. ( I could not stop it with the Windows Task Manager.)

2. I closed every programme, including every programme in the system tray. (I had already instructed Secunia PSI not to start at boot, so that was not an issue. Also, I am using Secunia 2.0.0.4002)

3. I even closed Kaspersky PURE and disconnected the internet.

4. I ran the programme "uninstall_flash_player_64bit.exe" from Adobe's website, because I had by that stage reinstalled the two flash players using the version 11.0.1.152 files "install_flash_player_ax_64bit.exe" and "install_flash_player_64bit.exe".

5. I looked in the two directories "C:\Windows\system32\Macromed\Flash" and "C:\Windows\sysWOW64\Macromed\Flash". There was no file "Flash9f.ocx" in either directory.
(By the way, I have never detected the file "Flash9f.ocx" in the other directory that you mentioned --- "C:\Windows\system32\Macromed\Flash" --- presumably because I have a 64-bit machine)

6. I reconnected the internet and restarted Kaspersky. The file "Flash9f.ocx" did not reappear.

7. I opened Secunia and ran a full scan --- Result: 100%. The file "Flash9f.ocx" did not reappear.

8. I immediately rebooted the computer --- WITHOUT reinstalling the updated versions of Flash.

9. IT'S BACK!!! The file has reappeared.
C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx

10. I ran the Secunia full scan, just for fun, and of course it is now 99% again because of file "Flash9f.ocx".

My previous questions remain, and I am completely at a loss as to what to do now.
Was this reply relevant?
+0
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 24th Oct, 2011 11:18
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
Last edited on 24th Oct, 2011 11:24
on 24th Oct, 2011 10:25, ParzivalRM wrote:
Thanks for replying so quickly. No success, however, I'm afraid.

[...]

4. I ran the programme "uninstall_flash_player_64bit.exe" from Adobe's website, because I had by that stage reinstalled the two flash players using the version 11.0.1.152 files "install_flash_player_ax_64bit.exe" and "install_flash_player_64bit.exe".

[...]

My previous questions remain, and I am completely at a loss as to what to do now.


You might want to try the 32-bit uninstaller. Did you attempt that? The ghost Flash9x.ocx might appear due to 32-bit to 64-bit Win 7 conversion magic.

The 64-bit uninstaller just might not be equipped with the right thing to do for the ancient 32-bit version Flash9f.ocx.

Also, Flash9f.ocx is somewhat archaic. 10.x line version is now 10.3.183.10 and 11.x line is at the time of writing 11.0.1.152.

Rgdz,
Marv


Rgdz,
Marv


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 24th Oct, 2011 11:52
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Thanks for the suggestion. Yes, I did try Adobe's 32-bit uninstaller before my first posting, but it wouldn't run at all because the machine is 64-bit.

I know that Flash9f.ocx is archaic. That's why I am trying to get rid of it.
Was this reply relevant?
+1
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 24th Oct, 2011 15:39
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
You could try disabling start-up programs to check if something you have there is reinstalling it.

Otherwise, I think you will only find out what is happenning by using Process Monitor with boot logging.
http://technet.microsoft.com/en-us/sysinternals/bb...

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+1
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 25th Oct, 2011 10:43
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 25th Oct, 2011 10:47
Have U managed to fix this yet with the possible solutions offered?

I THINK I have reproduced your problem - fairly lengthy post required to explain which I will not complete or publish unless required.

EDIT:
If U want a reply could U please confirm:
1. U are using Windows 7 SP1.

2. What browsers U have installed & which one is set as THE DEFAULT.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 25th Oct, 2011 11:26
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Thank you very much for these remarks. Yes, I would like some detailed instructions as to how to proceed.

* I installed Process Monitor.
* I deleted C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx without a problem.
* I rebooted, and I immediately started Process Monitor,.and navigated quickly to
C:\Windows\SysWOW64\Macromed\Flash so that I could see when Flash9f.ocx reappeared.
* When C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx reappeared, after a minute or so, I stopped Process Monitor and searched for Flash\Flash9c.ocx.
* But I got confused trying to make sense of the logfile. A whole lot of ordinary-looking programs seem to be stated by Process Monitor to have succeeded in creating the file C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx, and the list started way before I actually saw it appear in the directory. I'm no techie, and I couldn't sort it out. Specifically, the programmes that Process Monitor seemed to say had created Flash9c.ocx were:
AsScrPro.exe, avp.exe (Kaspersky), regsvr 32.exe and dopus.exe (Directory Opus)

I haven't had time yet to go through the disabling startup programmes procedure

To be absolutely specific, everything is obsessively updated on an ASUS laptop:
* 64-bit Windows 7 Home Premium SP1, fully updated
* IE9 and Firefox 7.0.1 installed, with Firefox the default (with many extensions)
* Kaspersky PURE 9.1.0.124(b)
* Secunia PSI 2.0.0.4002
* Directory Opus 10.0.2.0
* The Bat! 5.0.24
* ... ... ... ...
I have not yet reinstalled either IE Flash nor non-IE flash.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 25th Oct, 2011 11:55
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 25th Oct, 2011 11:56
Thank U. Very interested to see that somehow a Flash file is being recreated. Is the monitor file U are having difficulty with in a format that U could sent to me by email attachment?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 25th Oct, 2011 12:47
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Last edited on 25th Oct, 2011 13:02
Confusingly, the Windows CreateFile function is also used to open existing files. You need to look at the first occurrence and for writes to the file.

To ensure you get to the earliest references possible, you would select 'Enable Boot logging' on the Options menu and restart Windows. This will start logging early in the boot process and stop logging when you start Process Monitor again.

Update
AsScrPro.exe seems to be something called Asus Screensaver Protector. I think that would be first thing I tried disabling in the Start-up programs.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
scanweb RE: Flash9f.ocx keeps reappearing
Member 25th Oct, 2011 14:21
Score: 0
Posts: 1
User Since: 25th Oct 2011
System Score: N/A
Location: NO
Have you tried removing all of the new flash, reboot.

Then reinstall flash 10.3?

That worked for me.

best regards and good luck.
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 01:45
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Thank you, Maurice and ddmarshall. for your continuing involvement.

Maurice, the file Flash9f.ocx is 2.85MB, so it should go as an email attachment. How should I go about sending it?

In the light of the following notes, perhaps I should also include a listing of all files in the directory, and subdirectories of,
C:\Program Files (x86)\ASUS
- - - - - - - -

ddmarshall, I also suspect the ASUS proprietry software. I perhaps should have mentioned that I had searched the whole of C:\ drive for *Flash*, where I found a Flash installer, version 10.1.85.3, in the directory
C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\
I deleted it (and then ran CCleaner), but it did not change the offending behaviour.

There was also another .exe file
C:\Program Files (x86)\ASUS\\WinFlash\WinFlash.exe
which I did not delete because I do not know what it is. There were no other .exe files. It all looks a little suspicious --- hence my comment to Maurice above about a list of files. Why does a major hardware manufacturer include software installers that will very soon become outdated?

I have now checked the 'run at boot' option on Process Monitor, deleted Flash9f.ocx, and rebooted. . . . . . First time, it hung and I did a cold reboot. Second time, it was still hanging after half and hour. Apologies if I have mucked something up there.
Was this reply relevant?
+0
-0
mbarley42 RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 05:50
Score: -4
Posts: 40
User Since: 17th Jun 2011
System Score: N/A
Location: HR
I just thought, if something unlinks Flash9f.ocx, but it is still locked by some process, then it could be that NTFS file system journal replay brings it back.

Does that seem credible?

Rgdz,
Marv


--
Be the change you wish to see in the world.
Mahathma Gandhi
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 26th Oct, 2011 09:56
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
This is the detail on Winflash

http://www.processlibrary.com/directory/files/winf...

Send anything to me U like. Once I know U are sat at your PC I will publish my email address - after I short time I will delete the post with my address on.

If that crude methods fails I will ask Secunia Support if they will relay it to U.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
mtodorov2 RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 10:38
Score: 1
Posts: 14
User Since: 26th Oct 2009
System Score: N/A
Location: N/A
The only remaining solution seems to remove Flash9f.ocx and then use free space wiping tool like Ccleaner. That should kill the critter.

Marv
Was this reply relevant?
+0
-1
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 11:05
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Maurice, I have emails prepared and ready to go:
* to send the offending file Flash9f.ocx that keeps reappearing
* To send the complete listing of files in C:\Program Files (x86)\ASUS\

I will be sitting at my computer for some time now with work to do.
Was this reply relevant?
+0
-0

Maurice Joyce

RE: Flash9f.ocx keeps reappearing
[+]
This reply has been deleted
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 11:12
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Got it! Thanks.
Was this reply relevant?
+0
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 26th Oct, 2011 13:10
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
on 26th Oct, 2011 11:12, ParzivalRM wrote:
Got it! Thanks.


Thank good heavens!

What of the things we said did remove the critter?

IJC
Marv


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 26th Oct, 2011 18:18
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Sorry that I haven't been able to get back to you sooner.

If you have problems booting with boot logging activated, you can deactivate boot logging by choosing the Last Known Good option from the Windows boot menu (which you access by pressing F8 during the boot).

If you can't work anything out with Maurice, save the Process Monitor log of the file reappearing in the folder in native (.pml) format. Zip it and upload to a public SkyDrive and I'll see if I can spot anything.


--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 27th Oct, 2011 02:16
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
ddmarshall, It turned out that there was a ProcMon log file after the "half-hour boot", but it was up to the gigabyte size. Nevertheless, I think I managed to get the right information from it on the creation of flash9f.ocx, and I have sent all the early entries involving flash9f.ocx off to Maurice. The most important lines seemed to be:

10:14:28.4448833 AsScrPro.exe 3216 CreateFile C:\W indows\SysWOW64\Macromed\Flash\Flash9f.ocx SUCCESS Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0, OpenResult: Created
10:14:28.4828225 AsScrPro.exe 3216 WriteFile C:\Wi ndows\SysWOW64\Macromed\Flash\Flash9f.ocx SUCCESS Offset: 0, Length: 2 991 488, Priority: Normal
10:14:28.4894279 AsScrPro.exe 3216 CloseFile C:\Wi ndows\SysWOW64\Macromed\Flash\Flash9f.ocx SUCCESS

The previous 4 mentions of Flash9f.ocx, involving first svchost.exe and AsScrPro.exe were all marked NAME NOT FOUND.

I also sent him the complete listing of files in C:\Program Files (x86)\ASUS\ and subdirectories. Everything is pointing that way.

If Maurice wants more information, I'll get back to you for finer details about boot logging and F8, and also about skydrive, which I have never used. Thanks for your concern.

mtodorov, the problem is not solved --- I was just expressing satisfaction that I had been able to send information to Maurice. Sorry for the confusion.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 27th Oct, 2011 17:29
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I have sent two emails to U. Awaiting reply.

Have U seen this?

http://vip.asus.com/forum/view.aspx?id=20091210182...

Read the threads & it looks like it is ASUS + it gives a solution.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 27th Oct, 2011 19:47
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
That confirms that AsScrPro.exe is writing it back to the Windows directory. It must have its own copy hidden away.

This is really unbelievable behaviour for a program supplied by an OEM. It's probably not much of a security risk as long as the latest version is the one that's registered on the system for Internet Explorer to use.

The stuff about F8 was only to use if you got into the situation where you couldn't reboot normally.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 27th Oct, 2011 20:51
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I agree - looks like no action from the vendor for years - it is indeed hidden:

Author: ASUSTeK Computer Inc
Part Of: ASScrPro.exe
Common path(s): %WINDOWS%
Keywords(s): hidden
Filesize(s): 24,576 bytes, 33,136 bytes

If difficulty remains in removing it Secunia might endorse the fact that an Ignore Rule could safely be set up.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 28th Oct, 2011 01:00
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Yes, ASUS is looking more and more like the cause. The built-in Windows Disk Management in the Control Panel doesn't show up any hidden ASUS OEM partition --- not that one would expect it to.

Maurice, in reply to our email this morning, I did reply yesterday, sending the correct files instead of the wrong ones --- that email seems to have gone astray, however. I have just now replied again with two emails, the first includes the lost email without attachments, the second includes the lost email with attachments. We'll see if these emails get through.

By the way, surely ASUS monitors these forums. Why don't they supply a solution?
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 30th Oct, 2011 23:53
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I have written to Secunia Support on this issue & have forwarded the log file.

Hopefully they will investigatethe the points I have made & respond on this thread.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+3
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 4th Nov, 2011 10:52
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 4th Nov, 2011 11:40
.@ParzivalRM

I will bring this issue to the "top of the pile" to prevent it being auto locked.

As U are aware,I contacted Support on 29th October for advice & enclosed your log file. I sent a reminder on 1st November. To date there has been no acknowledgement or advice forthcoming.

My reminder email also included details regarding this thread.

http://secunia.com/community/forum/thread/show/116...

I know they were tinkering yesterday (the server(s) threw a wobbly!) & the problem outlined above was fixed.

Did they by chance fix your issue as well? Worth trying a full rescan to see what happens & posting back to the Forum to keep @ddmarshall "in the loop" on progress.

Unfortunately until they respond there is little else I can do. I would not advise creating an Ignore Rule at this stage but my gut feeling is that it is harmless in it's current configuration.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 4th Nov, 2011 12:38
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
I've just done another full Secunia scan of the ASUS notebook, and the situation is unchanged. As before, the score is 99%, with the only problem reported being that Adobe Flash Player 9.x (ActiveX) is declared as end-of-life.

Underneath the heading "Detected Instances" is the entry:
C:\Windows\SysWOW64\Macromed\Flash\Flash9c.ocx, version 9.0.124.0 (ActiveX)
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 4th Nov, 2011 16:07
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Thank you. So no change there. Looks like we are in a waiting game!!

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 10th Nov, 2011 12:16
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
.@ParzivalRM

I will bring this to the top of the pile again to prevent it being auto locked. Secunia Support have acknowledged they have my emails which included your log files.

Hopefully they will respond in due course.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
This user no longer exists RE: Flash9f.ocx keeps reappearing
Member 11th Nov, 2011 13:02
Hi,

First off, I have to say that an issue such as this is not the sort of issue that Secunia aims to solve. We work with detecting and patching the programs, and if a third-party program is adding this file automatically, it is outside our field of focus.

However, you can try using Sysinternals Process Monitor(This is an advanced tool) to see which process is creating the file: http://technet.microsoft.com/en-us/sysinternals/bb...

After installing and launching it, repeat the steps to reproduce the issue. Then, whichever process touches or creates Flash9f.ocx is most likely responsible.

Hope this helps.
Was this reply relevant?
+0
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 11th Nov, 2011 16:09
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
I'd proceed like this.
Download Autoruns from Sysinternals. http://technet.microsoft.com/en-us/sysinternals/bb...
Search for AsScrPro.exe in the Autoruns listings.
Uncheck any entries you find to disable them.
Delete Flash9f.ocx
Reboot.

Alternatively, uninstall any preinstalled Asus programs you can do without and check whether this Flash9f.ocx stops being recreated.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 14th Nov, 2011 01:04
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
I already had autoruns.exe from the sysinternals suite. I ran it and searched for AsScrPro in the default "Everything" tab, but there is no such entry. There was also no result searching for "Flash", and the result searching for "Adobe" did not seem relevant. Apologies in advance if I have done something silly.

There are 12 installed ASUS programmes. Some are useless games, others are video and camera enhancements, and others, like LiveUpdate, Fancystart and ASUS_N3_Series look significant. Uninstalling seems a bit radical.

And thanks again for the continuing interest.
- - - - - - - -

The following details about Flash Installation problems are probably not relevant, but I will report them just in case. I waited until the new version 11.1.102.55 of Flash came out this weekend before reporting. These are the steps I took this morning.
* Run Adobe Flash uninstaller.
* Use jv16 to remove a flash installer.
* Use jv16 to clean the registry.
* Cold reboot
* Reinstall IE Flash and non-IE Flash by running the two 64-bit installers downloaded from the FileHippo website. (They apparently include the 32-bit installers.)

At this point, YouTube runs on Firefox and on IE9, and FileHippo reports 32-bit and 64-bit Flash up to date, both IE and Non-IE (four programmes altogether).

* Reboot

Now YouTube runs on the 64-bit version of IE9, but not on the 32-bit version of IE9, and not on Firefox.
* FileHippo reports that 32-bit Non-IE flash is out of date ("Installed version: Unknown, C:\Windows\SysWOW64/Macromed/Flash"), and that the 32-bit IE Flash and both 64-bit Flash programmes are up to date.
* Windows "Programs and Features" and jv16 both report two 64-bit Flash version installed, and do not list either 32-bit installer.
* (. . . and as usual, running the flash uninstaller removed flash9f.ocx, and it reappeared after rebooting.)

It looks as if Adobe and ASUS don't like each other, or perhaps Adobe doesn't like 64-bit computers.
Was this reply relevant?
+0
-0

ParzivalRM

RE: Flash9f.ocx keeps reappearing
[+]
This reply has been deleted
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 14th Nov, 2011 01:06
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
I already had autoruns.exe from the sysinternals suite. I ran it and searched for AsScrPro in the default "Everything" tab, but there is no such entry. There was also no result searching for "Flash", and the result searching for "Adobe" did not seem relevant. Apologies in advance if I have done something silly.

There are 12 installed ASUS programmes. Some are useless games, others are video and camera enhancements, and others, like LiveUpdate, Fancystart and ASUS_N3_Series look significant. Uninstalling seems a bit radical.

And thanks again for the continuing interest.
- - - - - - - -

The following details about Flash Installation problems are probably not relevant, but I will report them just in case. I waited until the new version 11.1.102.55 of Flash came out this weekend before reporting. These are the steps I took this morning.
* Run Adobe Flash uninstaller.
* Use jv16 to remove a flash installer.
* Use jv16 to clean the registry.
* Cold reboot
* Reinstall IE Flash and non-IE Flash by running the two 64-bit installers downloaded from the FileHippo website. (They apparently include the 32-bit installers.)

At this point, YouTube runs on Firefox and on IE9, and FileHippo reports 32-bit and 64-bit Flash up to date, both IE and Non-IE (four programmes altogether).

* Reboot

Now YouTube runs on the 64-bit version of IE9, but not on the 32-bit version of IE9, and not on Firefox.
* FileHippo reports that 32-bit Non-IE flash is out of date ("Installed version: Unknown, C:\Windows\SysWOW64/Macromed/Flash"), and that the 32-bit IE Flash and both 64-bit Flash programmes are up to date.
* Windows "Programs and Features" and jv16 both report two 64-bit Flash version installed, and do not list either 32-bit installer.
* (. . . and as usual, running the flash uninstaller removed flash9f.ocx, and it reappeared after rebooting.)

It looks as if Adobe and ASUS don't like each other, or perhaps Adobe doesn't like 64-bit computers.
Was this reply relevant?
+0
-0
ddmarshall RE: Flash9f.ocx keeps reappearing
Dedicated Contributor 14th Nov, 2011 15:31
Score: 1208
Posts: 960
User Since: 8th Nov 2008
System Score: 98%
Location: UK
I'm baffled.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 14th Nov, 2011 18:06
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I to am a little baffled by your latest Flash set up. I think we need to get Flash up & running correctly before trying to solve the original vulnerability.

I run a 64 Bit & a 32 Bit Windows 7 OS.

Flash is not OS reliant but browser. By default all browsers (including IE) use the 32Bit version therefore U do not require the 64Bit Flash unless U use a 64Bit browser with the bonus of Flash installed.

I do not,for example, have Flash installed for my 64Bit browser.

Do U use/want both?

U could try using my bog standard solution for Flash to see if that corrects your current lack of functionality.

UPDATING THE STANDALONE ADOBE FLASH PLAYER

If not using the PSI automatic update feature I would recommend this method to successfully update Flash which by-passes the Adobe Download Manager.


1. Download & SAVE these to desktop.

IE & Other Browsers using the Trident Rendering Engine.

http://fpdownload.adobe.com/get/flashplayer/curren...

& then here, if U have any Gecko based browsers that does not have Flash embedded.

http://fpdownload.adobe.com/get/flashplayer/curren...


2. The installer will appear on the desk top. THE IMPORTANT BIT - Before agreeing to install Flash check these programmes are completely shut down (use the Task Manager if necessary to COMPLETELY EXIT these processes if running):
a. All Browsers.
b. Windows Messenger.
c. Incredimail.
d. All Adobe Products.
e. PSI - Unless using version 2

3. [b]The new install will then remove all old files during the update process.

4. Complete a PSI rescan & all should be in order.
5. Delete the Flash installer(s) file(s) from the desktop.

If U want to double check Flash is working & the version installed click here: http://www.adobe.com/software/flash/about/ If using IE9 ActiveX Filtering must be disabled via IE>Tools before testing

Update 8 14:03 12/11/2011






--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 15th Nov, 2011 02:56
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
FIRST ATTEMPT: WITHOUT USING THE FLASH UNINSTALLER: I downloaded and installed the two 32-bit installers, after shutting everything conceivable down, including an Adobe update process for the Reader. I then deleted the installers and ran CCleaner to remove them from the recycle bin.
* There were now 4 Flash programmes in Windows "Programs and Features", two 32-bit and two 64-bit.
* YouTube ran successfully on Firefox, 32 bit IE9, and 64-bit IE9.
* Secunia had a 100% score.

I then rebooted, and everything went wrong.
* Windows "Programs and Features" still had all four Flash programmes, but the two 32-bit programmes had white rectangles instead of the red Flash icon.
* Secunia had a 99% score, complaining about C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx, version 9.0.124.0 (ActiveX)
* YouTube would not run on any browser. IE9 32-bit gave the error message:
"You need to upgrade your Adobe Flash Player to watch this video. Download it from Adobe. Upgrade to Flash Player 10 for improved playback performance."
Firefox had a black screen without controls, and nothing happened.
IE9 64-bit just had white space where the black screen should have been.
* FileHippo reported that 32-bit Non_IE needs updating, "Installed Version: Unknown C:\Windows\SysWOW64\Macromed\Flash", but reported the other three as OK.
* The Adobe website does not report flash installed on any of Firefox, IE9 32-bit or IE9 64-bit.

QUESTION: Is the IE9 32-bit message, ". . . Upgrade to Flash Player 10 . . . an indication that the wretched "Flash9f.ocx" file is confusing the installation?
- - - - - - - -

SECOND ATTEMPT: FIRST RUN THE FLASH UNINSTALLER (only the 64-bit uninstaller will run) plus jv16 plus registry cleaner plus CCleaner cold reboot, then install both 32-bit installers exactly as before.
* There are now only the two 32-bit Flash programmes on Windows "Programs and Features".
* Firefox and 32-bit IE9 run YouTube successfully, and the Flash website reports Flash installed on each browser.
* Secunia score is 100%.

I then rebooted, and everything went wrong again.
* Windows "Programs and Features" had both Flash programmes, but with white rectangles instead of the red Flash icon.
* Secunia had a 99% score, complaining as usual about C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx, version 9.0.124.0 (ActiveX)
* YouTube would not run on either Firefox or 32-bit IE9. The 32-bit IE9 gave the same error message as before
"You need to upgrade your Adobe Flash Player to watch this video. Download it from Adobe. Upgrade to Flash Player 10 for improved playback performance."
Firefox had the same black screen without controls.
* FileHippo's report is now most interesting:
1. 32-bit Non_IE needs updating, "Installed Version: Unknown C:\Windows\SysWOW64\Macromed\Flash".
2. 32-bit IE needs updating, "Installed Version: 9.0.124.0 C:\Windows\SysWOW64\Macromed\Flash".
* The Adobe website does not report flash installed on any of Firefox, IE9 32-bit or IE9 64-bit.

QUESTION: I checked using Directory Opus that 9.0.124.0 is indeed the version of the file C:\Windows\SysWOW64\Macromed\Flash\Flash9f.ocx, and FileHippo this time is reporting this version precisely as the installed version. This, along with the 32-bit IE9 error message on YouTube, seem pretty conclusive proof that the reappearance of Flash9f.ocx is what is wrecking the installation of Flash about reboot.

It's interesting that my previous posting reported the situation when I reinstalled the 64-bit versions of Flash after running the Flash uninstaller. That procedure at least left Flash functioning on the 64-bit IE9 after reboot.
- - - - - - - -

It looks more and more definite that ASUS is causing these problems by its boot procedures, which create an out-of-date version of Flash. Perhaps I should now follow this all up with them through Harris Technologies, Sydney, which is the excellent and extremely helpful shop where I bought the notebook.
Was this reply relevant?
+0
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 15th Nov, 2011 06:37
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
I recommend you use some startup checker like runalyzer and eliminate one by one things that run on startup. Then, when you isolate what does the reinstall of Flash9f.ocx, you can deal with single threat instead of shooting ghosts around.

Stay well
mt


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 15th Nov, 2011 11:23
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I do not think there is any doubt we have found the root cause.

Equally, Secunia appear to be saying that it is not a false positive despite the fact that this file has been on your PC a long time but it only became vulnerable once U updated to PSI version 2.0.0.4003.

I suspect that @ddmarshall has,once again, given another possible solution by removing some of the ASUS dross which I support.

U appear to have (using your words) 3 or 4 "useless" games. Games tend to use Flash elements either direct or via Shockwave if created by Adobe Director. If the file is embedded in those games only the vendor can fix it.

I would certain remove them. If that does not remove the file direct delete it manually before trying your reboot procedure.

I would continue removing all the ASUS OEM ware one by one but I appreciate U may not wish to do that & prefer to take it to a shop for a second "hands on" opinion/fix.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 15th Nov, 2011 14:58
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
Hi Maurice,

You have a good point said here.

Anyway, many of the programs do not need to run at startup out of the whole lineup from system tray many will offer option to start up on logon or not.

runalyzer can help here because it can find odd places from which system tray programs are being started. It is beta, but it comes from the proven Spybot Search & Destroy development team.

Stay well,
mt


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 15th Nov, 2011 16:21
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
It really is no good keep going on about looking at the start up menu. He cannot find the programme that is causing the file to RE INVENT itselfs at boot.

The programme hogging that file needs to be found & removed or found & then see if the vendor has an update - unlikely given it is OEM & over 4 years old.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 16th Nov, 2011 02:22
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
Thank you very much Maurice and ddmarshall and mtodorov for all your continuing advice on this issue.

I used jv16 to shut down progressively more and more startup programmes, but Flash9f.ocx still keeps appearing about a minute after logon.

I have now shut down every startup programme with ASUS or Adobe in its name, Cyberlink software, Acronis software, Realtek software, ExpressGate software and AsScrPro.exe, Everything else is either a programme that is continually updated, or a programme that I do not recognise and could be dangerous to shut down.

I installed Runalyzer on my own PC first to check it out (32-bit Windows 7), but there were "This software has not installed properly" problems, I couldn't make sense of the Runalyzer screen, the help file was blank, and the programme is really only suppose to work on Vista, not Windows 7, although I know people are using it on Windows 7.

So I'm a layman. But I reckon I have done due diligence, and it's now time to go back to the shop (when my wife can spare the notebook for a while). I'll present the techies with a copy of this forum webpage and see what they come up with. I will then report back on this forum
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 12th Dec, 2011 11:07
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Thread unlocked to enable originator to update the Forum.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ParzivalRM RE: Flash9f.ocx keeps reappearing
Member 13th Dec, 2011 05:15
Score: 13
Posts: 41
User Since: 15th May 2010
System Score: N/A
Location: AU
I can happily report that I have now managed to stop the reappearance of Flash9f.ocx after reboot.

The following steps achieved nothing:
* My computer shop: They were not really interested.
* ASUS updates: Checked --- everything is fully updated.
* Malware: Full scan with Kaspersky and Malwarebytes --- nothing found.
* Undeleted files: Wipe free space with CCleaner.

I then found this thread on the Adobe Flash forums:
http://forums.adobe.com/message/2458523#2458523
which described precisely the same problem of Flash9c.ocx reappearing on ASUS computers. I thought that I had disabled AsScrPro.exe, but apparently I had not. The programme seems not to be a core Windows programme, but an ASUS programme that has something to do with screen savers, which I don't use, so it seemed OK to disable it.

I therefore deleted Flash9f.ocx for the umpteenth time, then went into C:\Windows and renamed AsScrPro.exe as
AsScrProGOAWAY.exe
This worked --- flash9f.ocx never reappeared after successive reboots. Secunia is now 100%, and stays 100% after reboot and rescan.. (There remains a problem with Flash working only on IE9 and not on Firefox after reboot, but that is not a security problem and so has nothing to do with Secunia, and --- so what's new, this is Adobe Flash!)

So my insecurity problem is fixed! Thank you very much indeed to everyone who posted advice on the Forum, and particularly to Maurice, who persisted to the end through all the turgid details.
Was this reply relevant?
+6
-0
mtodorov RE: Flash9f.ocx keeps reappearing
Member 13th Dec, 2011 09:35
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
I thought Runalyzer from proven Spybot S&D team would help you, since it numbers and lists odd ways of startup (registry, service, IE extension) in one place.

I admit it is not a program for beginners.

Glad your solution worked.

Cheers,
mt


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-0
Maurice Joyce RE: Flash9f.ocx keeps reappearing
Handling Contributor 13th Dec, 2011 10:03
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Original problem has been resolved.

Thread closed at: 09:01 13/12/2011

If required, this thread can be reopened for the originator by contacting me by email.


--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability