Adobearm.exe now being blocked by Sophos

RE: Adobearm.exe now being blocked by Sophos

Hugues D — Thu, 30 Nov 2017 10:44:41 GMT

Hi QC,

Yes just adobeARM.exe and it's exactly as screenshot in this thread:

"Windows cannot access the specified, path, or file...."

No real impact on acrobat itself but it's annoying for the user.

And so far, only reported by one user.

But anyway, we'll be moving soon to cloud version, so I won't waste much time with that, I was just hoping for an easy and quick fix if applicable.

NB. Pushing back the policies, or using 'protect this computer' again didn't helped

Thanks,

Hugues

RE: Adobearm.exe now being blocked by Sophos

QC — Thu, 30 Nov 2017 08:36:06 GMT

Hello Hugues D,

and it's just adobeARM.exe which seems to have an issue with Application Control? Blocking/unblocking is via the application name, if the application is "not on the same side" as All added by Sophos it's explicitly listed in the policy sent to the endpoint - otherwise not.
Blocked means the user gets a pop-up, an event is sent to the console, and there's a message in the endpoint's SAV.txt? Do all endpoints have this problem?

Christian

RE: Adobearm.exe now being blocked by Sophos

Hugues D — Thu, 30 Nov 2017 07:18:45 GMT

I suppose that adobeARM.exe is "Acrobat Manager" but under which category is it hidden?

Can't find it in "Document Viewer"...

Thanks!

[EDIT] Nevermind the first question. Actually it's "Adobe Acrobat Reader and Manager" (name was too long to be displayed in the box), so it's already in the allowed list.

But even if the computer comply to the policy it's still blocked...

RE: Adobearm.exe now being blocked by Sophos

Jacob Painter — Mon, 10 Apr 2017 09:59:08 GMT

Very nice! I checked my logs and I do have a couple of instances of Adobe being blocked this morning but I had hundreds of instances prior to pushing the policy out on the 6th so I would say those are users that may not have received the policy for one reason or another.

RE: Adobearm.exe now being blocked by Sophos

LeePhipps — Mon, 10 Apr 2017 09:55:59 GMT

Sorry all fixed I just needed to add the Adobe Reader and Acrobat manager to the authorized list

RE: Adobearm.exe now being blocked by Sophos

LeePhipps — Mon, 10 Apr 2017 09:44:10 GMT

Thanks for the quick reply Jacob I already have that added into the application control list but the user says he is still getting the error.

The weird thing is I don't see this in my application control logs did any of your guys see it in your logs?

RE: Adobearm.exe now being blocked by Sophos

Jacob Painter — Mon, 10 Apr 2017 09:32:26 GMT

Thursday I updated our App control policy to include Adobe Acrobat Reader DC and pushed it out. Just got a report from an end user this morning that they had not gotten any alerts in a few days and successfully opened several PDF's this morning. FWIW, I'm attaching our current settings...

RE: Adobearm.exe now being blocked by Sophos

LeePhipps — Mon, 10 Apr 2017 09:18:06 GMT

Has anyone had an update on this as we are having the same issue?

RE: Adobearm.exe now being blocked by Sophos

Mike Taggart — Wed, 05 Apr 2017 21:11:33 GMT

My company has an open support case with Sophos about this and I've directed them to this thread to follow to show there are others with the same issue.

Regards,

Mike

RE: Adobearm.exe now being blocked by Sophos

Jacob Painter — Wed, 05 Apr 2017 17:36:40 GMT

Having the same issue here. Just tried allowing the apps and pushed the policy out, we'll see how things go.

RE: Adobearm.exe now being blocked by Sophos

Mike Taggart — Wed, 05 Apr 2017 11:11:01 GMT

If you look in Document Viewer you'll find it. But even after you allow the app, it doesn't help. The only thing I've found that resolves this is to uninstall/reinstall Sophos on the end point. I'm not doing that for 800 computers. Sophos needs to step up and fix this issue.

RE: Adobearm.exe now being blocked by Sophos

B�chir Ghedhoui — Wed, 05 Apr 2017 10:58:48 GMT

Hi,

We have the same problem here with our computers protected by Sophos Central.

We've already authorized any application that contain words "adobe" or "reader" or "acrobat"

We can't find "Adobe Reader and Acrobat Manager" in any software category through Application control

look like something that going to be big and painful for sophos support....

RE: Adobearm.exe now being blocked by Sophos

QC — Wed, 05 Apr 2017 08:24:26 GMT

Hello Mike,

would be strange if the endpoints don't honour the Authorization. Do they indeed use and comply with the changed Application Control policy but still block the application (which one, the Application Control events contain just its name, not the file triggering the detection)?

Christian

RE: Adobearm.exe now being blocked by Sophos

Mike Taggart — Wed, 05 Apr 2017 08:10:41 GMT

It was being blocked by Application Control, but I had since changed that. However, the end points are still reporting that it is blocked and users are still seeing the error in the screen shot.

RE: Adobearm.exe now being blocked by Sophos

QC — Wed, 05 Apr 2017 06:59:58 GMT

Hello Mike,

it's blocked by Application Control? If so, what's the Application Type and name?

Christian