Windows – Completely remove Adobe Flash leftover files and registry keys

flashmalwarepermissionswindowswindows-registry

I've noticed some leftover registry keys from Adobe Flash although I removed it months ago:

HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia

I tried to delete them but I didn't have the necessary permissions so I made sure regedit.exe was running with admin privileges but it still wasn't possible. So I did some research and found this tutorial to take ownership of registry keys but the deletion still didn't work! After that I used runassystem.exe to open regedit.exe as SYSTEM but again the same error! And after that I tried to give the full ownership as SYSTEM to my user account and all Administrators… same error!

Well, then I searched my whole C: drive and found two folders: 

C:\WINDOWS\System32\Macromed\Flash
C:\WINDOWS\SysWOW64\Macromed\Flash

Both of them contain exactly the same files:

enter image description here

I tried to delete them as admin… didn't work! Not even with Lockhunter!

enter image description here

Lockhunter says there's no process blocking these folders so I tried to delete them but yet again… it didn't work! So I clicked "delete at next system restart" and rebooted. At log on it prompts that the deletion was successful but guess what? The folders are still there!

What the hell is this? In what world is such a behavior acceptable from a "legitimate" company?
How to delete Flash completely?

Best Answer

  • Delete the flash system files by running these commands in a batch file::

    for %%X in (
"%SystemRoot%\System32\Macromed"
"%SystemRoot%\SysWOW64\Macromed") do (
 takeown /F %%X /R /D Y
 icacls %%X /grant Everyone:F /T
 rd /S /Q %%X
 )

    Explanation: In this for command, it takes the two folder paths in it's %%X variable. Then takeown takes ownership of the two folders recursively without any prompt and icacls grants all rights for everyone user. rd command removes the directory recursively and quietly.

  • Delete the registry, first download SetAcl commandline tool and run these commands in a batch file::

    for %%X in (
"HKLM\SOFTWARE\Macromedia"
"HKLM\SOFTWARE\WOW6432Node\Macromedia") do (
SetACL.exe -on %%X -ot reg -rec cont_obj -actn setowner -ownr "n:Everyone"
SetACL.exe -on %%X -ot reg -rec cont_obj -actn ace -ace "n:Everyone;p:full"
reg delete %%X /F
)

    Explanation: As before for command passes the registry keys to SetACL.exe executable command. Here the Object name (-on) is the registry path, Object type (-ot) is registry, Action (-actn) is to set owner, and the owner should be Everyone. -rec is to continue as recursively. -actn ace -ace adds or modifies access control entries (ACEs). Multiple ACEs may be specified like that.

See the SetACL command in action::

SetACL command in action

Further reading::

Edit:: You may run these commands from command prompt. To do so use %X instead of %%X. Also if you see any permission error, then change the Everyone user to Administrator or to your user name. Like in icacls command use as:: icacls %%X /grant John:F /T if John is your user account name.

Related Question