https://forums.adobe.com/thread/1657605 First, most people wouldn't be aware of this which appears to have been going on for some time unless they ran something that monitors startup activity like Autoruns, WinPatrol, or the like. I became aware of it recently after a ver. .287 standalone FlashPlayer update after running Autoruns. The next piece of the puzzle is for a while now, I have been getting alerts from Emsisoft's behavior blocker about an attempted hidden download when running FlashPlayer update. The alert occurs at "Step 3." or final step of the installation. Of course, I have blocked that download without any effect on the FlashPlayer installation. The finally piece of the puzzle is on a regular basis, I run the "set devmgr show" and "set devmgmt.msc " commands from the command prompt and displayed hidden devices to look for hidden drivers. On more than one occasion, I have seen remnants of a disabled driver with a random number value very similar to the one shown in the above link and observed when I ran Autoruns. Those always puzzled me since I had no idea where they were coming from. I have also not seen another one since I have been blocking the hidden Abode download. Also deleting the Speed Launcher startup entry is ineffective since it reappears at next boot time. Abode has offered a somewhat hard to find fix which I did run and did permanently eliminate the startup entry. Using a little deductive logic and putting it altogether, it appears to me that Adobe is dropping a hidden driver as part of its update processing and executing that driver using Speed Launcher on next boot via RunOnce registry setting. The question is why such stealth and possibly nefarious activity?
