This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Adobearm.exe now being blocked by Sophos

Yesterday morning there was an update to our console that put Adobearm.exe in the list of blocked applications in which it had not been ever. We've moved it to the 'allowed' listing and pushed out the update to all end points. That doesn't seem to have helped, we get reports from end users all over the company that they receive the following error message:

How do we fix this without reinstalling Sophos on all end points? Apparently, the new policy update is not fixing the problem. We have 800 end points and we shouldn't have to reinstall the software on each of them to fix this. Reprotecting the end points doesn't fix it either - we tried on about 10 pc's. The only thing we were able to see that resolved it was an uninstall/reinstall of the Sophos AV software.

Thanks in advance.

Mike

This thread was automatically locked due to age.

0 QC over 7 years ago

Hello Mike,

it's blocked by Application Control? If so, what's the Application Type and name?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Taggart over 7 years ago in reply to QC

It was being blocked by Application Control, but I had since changed that. However, the end points are still reporting that it is blocked and users are still seeing the error in the screen shot.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to Mike Taggart

Hello Mike,

would be strange if the endpoints don't honour the Authorization. Do they indeed use and comply with the changed Application Control policy but still block the application (which one, the Application Control events contain just its name, not the file triggering the detection)?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 B�chir Ghedhoui over 7 years ago in reply to QC

Hi,

We have the same problem here with our computers protected by Sophos Central.

We've already authorized any application that contain words "adobe" or "reader" or "acrobat"

We can't find "Adobe Reader and Acrobat Manager" in any software category through Application control

look like something that going to be big and painful for sophos support....
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Taggart over 7 years ago in reply to B�chir Ghedhoui

If you look in Document Viewer you'll find it. But even after you allow the app, it doesn't help. The only thing I've found that resolves this is to uninstall/reinstall Sophos on the end point. I'm not doing that for 800 computers. Sophos needs to step up and fix this issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jacob Painter over 7 years ago

Having the same issue here. Just tried allowing the apps and pushed the policy out, we'll see how things go.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Taggart over 7 years ago in reply to Jacob Painter

My company has an open support case with Sophos about this and I've directed them to this thread to follow to show there are others with the same issue.

Regards,

Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 LeePhipps over 7 years ago in reply to Mike Taggart

Has anyone had an update on this as we are having the same issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jacob Painter over 7 years ago in reply to LeePhipps

Thursday I updated our App control policy to include Adobe Acrobat Reader DC and pushed it out. Just got a report from an end user this morning that they had not gotten any alerts in a few days and successfully opened several PDF's this morning. FWIW, I'm attaching our current settings...
Cancel
Vote Up 0 Vote Down

Cancel
0 LeePhipps over 7 years ago in reply to Jacob Painter

Thanks for the quick reply Jacob I already have that added into the application control list but the user says he is still getting the error.

The weird thing is I don't see this in my application control logs did any of your guys see it in your logs?
Cancel
Vote Up 0 Vote Down

Cancel