Fake Flash update tricked you? Here's how to kill the malware

You clicked the fake Flash update. Now what?

That giant red banner screaming "Your Flash Player is out of date" — the one with the countdown timer — it's not Adobe. It's a loader for something nasty, usually a trojan or adware. Don't panic. You can clean this up in under 20 minutes if you follow these steps exactly.

Step 1: Kill the running malware process

Open Task Manager. Press Ctrl + Shift + Esc all at once. If you're on Windows 11, it's the same shortcut.

Look for any process named something like FlashUpdate.exe, AdobeFlashUpdater.exe, FlashHelper.exe, or just a random string of letters like svchost.exe running from a weird folder. Real svchost lives in C:\Windows\System32. Anything else is suspect.

Right-click the suspicious process and select End task. The popup should disappear — that's your confirmation you killed the active part. If the popup comes back within 30 seconds, you've got a persistent variant. Skip to Step 4 first, then come back.

Step 2: Remove the malicious scheduled task

Most fake Flash installers create a scheduled task so they survive a reboot. Kill that now.

1. Open Task Scheduler: hit Win + R, type taskschd.msc, press Enter.
2. In the left pane, click Task Scheduler Library.
3. Look through the list for anything named Adobe Flash Updater, Flash Update, AdobeUpdateTask, or a random name with a high number like UpdaterTask_4839.
4. Click it once. In the bottom pane, look at the Actions tab. If the path points to C:\Users\[YourName]\AppData\Local\Temp\ or AppData\Roaming\, that's your culprit.
5. Right-click the task and select Disable first. Then right-click again and Delete.

After you delete it, the popup shouldn't reappear on the next login.

Step 3: Clean your browser — the real hiding spot

This fake Flash update often comes as a browser extension that shows fake notifications. Here's how to nuke it per browser.

Chrome

1. Click the three dots in the top-right, then Extensions > Manage Extensions.
2. Turn off every extension you don't recognize. Especially ones named Flash Player, Adobe Flash, Video Downloader Plus, or anything with a generic icon.
3. Click Remove on the suspicious ones.
4. While you're there, click Details on any extension you kept and check the Site access section. If it says "On all sites" and it's not something like LastPass or Grammarly, remove it.

After that, reset Chrome notifications: go to chrome://settings/content/notifications. Under Allow, remove any site you don't trust. Especially ones that look like notification-center-xyz.com or flashupdate.net.

Firefox

1. Click the hamburger menu (three lines), then Add-ons and themes.
2. Go to Extensions. Remove anything you didn't intentionally install. Look for names like Adobe Flash Update or Media Player Helper.
3. Click the gear icon next to Extensions and select Reset all add-ons — this wipes out any hidden settings changes the malware made.

Step 4: Kill persistent variants with safe mode

Some recent versions (mid-2024, I've seen these in fake Flash updates for Firefox) inject a DLL into explorer.exe. That means you can't kill it in normal Task Manager. Here's the workaround:

1. Restart your PC. As soon as the screen goes black, start tapping F8 (or hold Shift while clicking Restart in Windows 10/11).
2. Select Safe Mode with Networking.
3. Once in safe mode, open Task Manager. The malware process won't be running because its startup tasks are disabled in safe mode.
4. Run a full scan with Malwarebytes (free version is fine). I use Malwarebytes every day for this — it catches the fake Flash payloads that Windows Defender sometimes misses.
5. Let Malwarebytes quarantine everything it finds. Reboot back into normal mode.

Step 5: Verify you're clean

After the scan and reboot, open a browser. Go to YouTube or any site that doesn't use Flash (which is all of them — Adobe killed Flash in 2020). If you don't see the red popup, you're clean. If you still see it, run Malwarebytes again. Sometimes these things drop a second copy in a different temp folder.

Why these steps work

Fake Flash update malware relies on three weaknesses: user clicks, persistence through scheduled tasks or browser extensions, and the fact that people don't check what's running. By killing the process, removing the scheduled task, and cleaning the browser extensions, you cut off all three legs of the stool. The scheduled task is the most common method I see — it's the one that brings the popup back after every restart. If you only kill the task and don't delete the extension, the extension can re-create the task. That's why I do both.

Less common variants to watch for

Not all fake Flash updates look the same. Here are a few I've run into on real machines:

• The fake Firefox alert: Shows a dialog that looks exactly like Firefox's built-in plugin notification. The text says "Flash Player requires a security update." Clicking anywhere on the dialog downloads a flash_player_setup.msi that's actually a remote access trojan (RAT).
• The Chrome download bar variant: A fake Chrome download bar appears at the bottom of the tab, saying "Adobe Flash Player is out of date." Clicking it downloads a ZIP file named FlashUpdate.zip. Inside is a .scr file (screensaver executable) that runs the malware.
• The Edge notification hijack: Microsoft Edge's native notification permission is abused. The malware adds a site to your allowed notifications list. That site then sends push notifications that look exactly like a Flash update warning.

For the Edge variant, go to edge://settings/content/notifications and remove every site you don't explicitly trust. Empty the whole list if you have to.

How to stop this from happening again

First, remember that Adobe Flash Player died on December 31, 2020. No legit website asks you to update Flash. None. Zero. If you see a popup asking you to update Flash, it's malware. Close the browser tab — don't click anything on the popup, not even the X. If the X doesn't work, force-close the browser from Task Manager.

Second, install an ad blocker. I recommend uBlock Origin (free, open-source, available for Chrome, Firefox, and Edge). It blocks the malicious ad networks that serve these fake update banners. I've been using it since 2018 and it's caught hundreds of these for clients.

Third, consider disabling browser notifications entirely unless you need them. In Chrome, go to chrome://settings/content/notifications and toggle Don't allow sites to send notifications. In Firefox, go to about:preferences#privacy and click Settings under Permissions > Notifications, then check Block new requests asking to allow notifications.

Fourth, keep your actual software updated. Adobe Flash is dead, but your browser, Windows, and PDF reader all need real updates. Let Windows Update run automatically. Set your browser to auto-update. If you need a PDF reader, use Microsoft Edge's built-in PDF viewer or the official Adobe Acrobat Reader (but only get it from get.adobe.com, not from a popup).