This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Adobearm.exe now being blocked by Sophos

Yesterday morning there was an update to our console that put Adobearm.exe in the list of blocked applications in which it had not been ever. We've moved it to the 'allowed' listing and pushed out the update to all end points. That doesn't seem to have helped, we get reports from end users all over the company that they receive the following error message:

How do we fix this without reinstalling Sophos on all end points? Apparently, the new policy update is not fixing the problem. We have 800 end points and we shouldn't have to reinstall the software on each of them to fix this. Reprotecting the end points doesn't fix it either - we tried on about 10 pc's. The only thing we were able to see that resolved it was an uninstall/reinstall of the Sophos AV software.

Thanks in advance.

Mike

This thread was automatically locked due to age.

Parents

0 Jacob Painter over 7 years ago

Having the same issue here. Just tried allowing the apps and pushed the policy out, we'll see how things go.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Taggart over 7 years ago in reply to Jacob Painter

My company has an open support case with Sophos about this and I've directed them to this thread to follow to show there are others with the same issue.

Regards,

Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 LeePhipps over 7 years ago in reply to Mike Taggart

Has anyone had an update on this as we are having the same issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jacob Painter over 7 years ago in reply to LeePhipps

Thursday I updated our App control policy to include Adobe Acrobat Reader DC and pushed it out. Just got a report from an end user this morning that they had not gotten any alerts in a few days and successfully opened several PDF's this morning. FWIW, I'm attaching our current settings...
Cancel
Vote Up 0 Vote Down

Cancel
0 LeePhipps over 7 years ago in reply to Jacob Painter

Thanks for the quick reply Jacob I already have that added into the application control list but the user says he is still getting the error.

The weird thing is I don't see this in my application control logs did any of your guys see it in your logs?
Cancel
Vote Up 0 Vote Down

Cancel
0 LeePhipps over 7 years ago in reply to LeePhipps

Sorry all fixed I just needed to add the Adobe Reader and Acrobat manager to the authorized list
Cancel
Vote Up 0 Vote Down

Cancel
0 Jacob Painter over 7 years ago in reply to LeePhipps

Very nice! I checked my logs and I do have a couple of instances of Adobe being blocked this morning but I had hundreds of instances prior to pushing the policy out on the 6th so I would say those are users that may not have received the policy for one reason or another.
Cancel
Vote Up 0 Vote Down

Cancel
0 Hugues D over 6 years ago in reply to Jacob Painter

I suppose that adobeARM.exe is "Acrobat Manager" but under which category is it hidden?

Can't find it in "Document Viewer"...

Thanks!

[EDIT] Nevermind the first question. Actually it's "Adobe Acrobat Reader and Manager" (name was too long to be displayed in the box), so it's already in the allowed list.

But even if the computer comply to the policy it's still blocked...
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Hugues D

Hello Hugues D,

and it's just adobeARM.exe which seems to have an issue with Application Control? Blocking/unblocking is via the application name, if the application is "not on the same side" as All added by Sophos it's explicitly listed in the policy sent to the endpoint - otherwise not.
Blocked means the user gets a pop-up, an event is sent to the console, and there's a message in the endpoint's SAV.txt? Do all endpoints have this problem?

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 6 years ago in reply to Hugues D

Hello Hugues D,

and it's just adobeARM.exe which seems to have an issue with Application Control? Blocking/unblocking is via the application name, if the application is "not on the same side" as All added by Sophos it's explicitly listed in the policy sent to the endpoint - otherwise not.
Blocked means the user gets a pop-up, an event is sent to the console, and there's a message in the endpoint's SAV.txt? Do all endpoints have this problem?

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Hugues D over 6 years ago in reply to QC

Hi QC,

Yes just adobeARM.exe and it's exactly as screenshot in this thread:

"Windows cannot access the specified, path, or file...."

No real impact on acrobat itself but it's annoying for the user.

And so far, only reported by one user.

But anyway, we'll be moving soon to cloud version, so I won't waste much time with that, I was just hoping for an easy and quick fix if applicable.

NB. Pushing back the policies, or using 'protect this computer' again didn't helped

Thanks,

Hugues
Cancel
Vote Up 0 Vote Down

Cancel