# Flash 7 Detected in scan but can't find on computer

**URL:** <https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506>\
**Category:** Event Sources\
**Created:** [August 23, 2021, 2:05pm UTC](https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506 "2021-08-23T14:05:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aaron\_denton](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/a/aca169/32.png) [@aaron\_denton](https://discuss.rapid7.com/u/aaron_denton)\
**Post date:** [August 23, 2021, 2:05pm UTC](https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506/1 "2021-08-23T14:05:05Z")

</div>

I have several machines that IVM is detecting Flash version 7 on but I don’t see that in the Add/Remove programs list of installed applications.  
What would trigger this detection and how do I fix it?

One example:

Status: Vulnerable Version  
Key: C:\Windows\syswow64\Macromed\Flash  
Proof: Vulnerable OS: Microsoft Windows 7 Professional Edition SP1

Vulnerable software installed: Adobe Flash 7.0.19.0 (C:\Windows\syswow64\Macromed\Flash)

---

<div class="post-metadata">

**Author:** ![aaron\_denton](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/a/aca169/32.png) [@aaron\_denton](https://discuss.rapid7.com/u/aaron_denton)\
**Post date:** [August 23, 2021, 9:14pm UTC](https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506/2 "2021-08-23T21:14:50Z")

</div>

Looks like the check is looking in the directory for .ocx files from Flash installs.  
Depending on the version, it may be Flash.ocx, or Flash9.ocx, etc.  
Right-clicking and viewing details shows the version.

After deleting Flash.ocx, the next scan did not list that device as having Flash 7 installed.

---

<div class="post-metadata">

**Author:** ![ccastro](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/c/45deac/32.png) [@ccastro](https://discuss.rapid7.com/u/ccastro)\
**Post date:** [April 26, 2022, 6:10pm UTC](https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506/3 "2022-04-26T18:10:23Z")

</div>

Thanks this is helpful.

---

<div class="post-metadata">

**Author:** ![aaron\_denton](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/a/aca169/32.png) [@aaron\_denton](https://discuss.rapid7.com/u/aaron_denton)\
**Post date:** [August 23, 2022, 5:15pm UTC](https://discuss.rapid7.com/t/flash-7-detected-in-scan-but-cant-find-on-computer/6506/4 "2022-08-23T17:15:29Z")

</div>

Just to add to this, I’ve also been completely removing C:\Windows\syswow64\Macromed which seems to help in some instances.