Trojan.Agent being reported for Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

[wisp]

Hi, not sure if this is a false-positive or not, but Acrobat Reader DC has auto-updated on several of our clients this morning and Malwarebytes is reporting the following in every single instance:

Trojan.Agent     Quarantined      C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

 

False positive or something more to it?

Thanks

[bnotestine]

We are getting it too. RdrCEF.exe and acrocef.exe are both being detected on multiple workstations in the environment this morning. They are being quarantined but I'm not sure yet if they are real detections or false positives. 

[CTMRuss]

I'm getting this across every one of my customers. Must be a mistake in the latest definition updates. Can we get this fixed ASAP??

[wisp]

Glad we're not the only one.  Removing the threat causes the Reader to go into repair mode on next open, only to reinstall the missing exe..

[RobinCM]

Same here. Does anyone from MalwareBytes monitor this or do we all need to formally notify them in some way?

[EcoFuelPlus]

Ive tested the file at VirusTotal and its not a virus/malware (according to them) 

we have had 80+ detentions from MBAM 

[Lewej]

Same here

[EcoFuelPlus]

There is a new database version (v2017.09.14.04) I wonder if they have fixed it in there 

[MohammedAzhar]

same here as well , whenever opening an attachment of pdf in outlook , poping up this alert.

[Thanasis]

we have getting too. Is it from a new acrobat version or something else?

 

[MKBistro]

The new database version does not appear to correct the issue

[Fatdcuk]

Hi guys

 

We are pushing an update currently to fix this f/p

 

Please can you up update and confirm that the detection no longers occurs.

 

Thanks in advance and our apologies for incovenience caused.

[RobinCM]

I've logged it via support (email only... not ideal for situations like this!)

[EcoFuelPlus]

5 minutes ago, Fatdcuk said:

Hi guys

 

We are pushing an update currently to fix this f/p

 

Please can you up update and confirm that the detection no longers occurs.

 

Thanks in advance and our apologies for incovenience caused.

What is the version of the "fixed" database ?

I can confirm v2017.09.14.04  *does not* fix it 

Edited September 14, 2017 by EcoFuelPlus

[Metallica]

1 minute ago, EcoFuelPlus said:

What is the version of the "fixed" database ?

MBAM2 Version: v2017.09.14.04
MBAM3 Version: 1.0.2802

[MohammedAzhar]

Thanks, v2017.09.14.04 issue reolve with this update.

[EcoFuelPlus]

v2017.09.14.04 does not appear to resolve it 

Edited September 14, 2017 by EcoFuelPlus

[arcdc]

v2017.09.14.04 not working for us either.  Just added to ignore list for now since its stopping people from working.

 

Spoke to soon, works for us.  I was testing previous definitions.  v2017.09.14.04 seems to have fixed the issue.

Thanks for the fast support

Edited September 14, 2017 by arcdc
I was wrong about my initial findings

[MKBistro]

Looks like we are ok now.  Notifications have stopped for us now so perhaps there was some latency after updating server. Thanks for a quick resolution!

 

[EcoFuelPlus]

1 minute ago, MKBistro said:

Looks like we are ok now.  Notifications have stopped for us now so perhaps there was some latency after updating server. Thanks for a quick resolution!

 

Yes same for us - fingers crossed 

[TrevorG]

For now what it did is Exclude this object for All Clients, and later once new build comes out you can Restore this Object for All Clients.

 

[TrevorG]

Disregard, Update finally came in.

[Thanasis]

The database version 2017.09.14.04 seems to solved the issue.

[EcoFuelPlus]

just had another notification - this time the database version was 2017.09.14.05 !

Im wondering if again this was a latency issue - maybe the machine was just turned on and detected the adobe file before updating to the latest database ....

 

Edited September 14, 2017 by EcoFuelPlus

[Fatdcuk]

5 minutes ago, EcoFuelPlus said:

just had another notification - this time the database version was 2017.09.14.05 !

 

 

 

Yup, i just pushed out the next lot of new defs for today to the database .

 

The faulting def was removed with the previous update cycle (#4) .

 

Again our thanks for reporting this guys and apologies for any inconvenience caused.

 

I will close this topic off now as it is now resolved.