Adobe Acrobat Pro 7.0 false positive

Viruses and worms
1

I opened a ticket on this already, but I’m covering all the bases :slight_smile:

We are running ADNM with the latest clients (still 4.8-based, sadly), and
since Friday (update 110909-1), Avast has been reporting a component of
Acrobat 7 Professional as a virus:

avast! [CITYCLERK]: File “C:\Program Files\Adobe\Acrobat 7.0\Distillr\ARE.dll” is infected by “Win32:Renosator [Cryp]” virus.

This disables Acrobat 7, which we have a lot of users on. Only workaround is to disable
avast on the workstation, since adding the path to the exclusion list doesn’t keep on-access
protection from checking it and complaining.

I’m hoping for a relatively speedy fix, but does anyone know of a workaround other than
shutting the network client off?

2

upload suspicious file(s) to www.virustotal.com and test with 44 malware scanners
when you have the result, copy the URL in the addressbar and post it here for us to see

alternative
Jotti`s http://virusscan.jotti.org/en
VirSCAN http://virscan.org/
Metascan http://www.metascan-online.com/

False Positives can be reported here, see dropp down menu
http://www.avast.com/en-no/contact-form.php?loadStyles&subject=SALES

3

Here’s the URL - only Avast thinks it’s infected:

http://www.virustotal.com/file-scan/report.html?id=9ed0be850ae3b234f5ba0e287d84fb4e6caa565fce66a9279807a8c9de913c2d-1315664951

I have already reported it as a false positive via a support ticket, but I’ll do it via the contact form as well. My purpose in posting here was to see if there’s a way to exclude this file from the on-access protection scanner, since that’s explicitly excluded from processes which the built-in exclude list pertains to.

4

you may add a link to this topic in the contact form…

anyway they monitor the forum so it is possible that they already have seen it…and sometimes respond here

5

Adobe’s file check: File : ARE.DLL
Path : %programfiles%\adobe\acrobat 7.0\designer 7.0
MD5 : c515083f7f815f464d1e65e4a441e539 - (258048 Bytes)

polonus

6

All seems to be peace and quiet here now… the latest
update ( 110912-1 ) seems to like Acrobat 7 once again.

Thanks, folks…

7

Hi ElderGeek,

You are welcome.
Stay safe and secure online is the wish of,

polonus

P.S. to check all is well again: http://www.virustotal.com/file-scan/report.html?id=9ed0be850ae3b234f5ba0e287d84fb4e6caa565fce66a9279807a8c9de913c2d-1315859174

8

this FP was fixed yesterday and current VPS shouldn’t detect it anymore… why a company like adobe don’t sign all binaries with a proper certificate (authenticode) is a question… valid signature would completely hush this particluar FP