Adobe Reader DC - Adware.IstartSurf issue

[user18954]

Adobe Reader DC is a pretty common program so this was strange to pop up on us. This is probably a false positive. But wanted to see what others thought.

C:\program files (X86)\adobe\acrobat reader dc\Reader\ccme_asym.dll
C:\program files (X86)\adobe\acrobat reader dc\Reader\ccme_ecc.dll

Adware.IstartSurf

 

[Fatdcuk]

Hi user18954

 

Please can you attach a copy of the scan log of the detections and zip and attach the detected files.

Thanks in advance

[user18954]

ADOBE-Malware-Reader.zip

2 files attached. OR just download the newest Adobe Reader DC and it installs, then finds the files on first scan.

Working on logs.

[user18954]

Part of Logs added

Logs-Adobe-Malare.txt

[jjreese]

Have you added an exception for these?  I'm being bombarded by notifications - I'm "assuming" this is a False Positive?

[user18954]

1 minute ago, jjreese said:

Have you added an exception for these?  I'm being bombarded by notifications - I'm "assuming" this is a False Positive?

Yes I whitelisted/added exception to get around it. I'm assuming false positive too.

 

[user18954]

Both home and business come up with the same issue. Trend Micro and ESET don't report anything wrong with the files FYI.

 

[robby_fr]

Hi,

Just got the same notifications from MalwareBytes. De-isntaklled and re-isnatlled Adobe Reader DC twice. Same.

Did anybody got the confirmation that it is actually a false positive?

Thanks

[Fatdcuk]

Thanks for reporting this guys.

Confirmed that these are f/p's and will be fixed on the next update cycle shortly.

Should be ~15minutes time.

Edited November 3, 2018 by Fatdcuk

[VickyTeehee]

Hello,

I had the exact same notification for this istartsurf thing, should I be worried ?

[jjreese]

5 minutes ago, VickyTeehee said:

Hello,

I had the exact same notification for this istartsurf thing, should I be worried ?

Read the posts. They’ve confirmed already that this specific detection is a FP. 

[Fatdcuk]

Hi VickyTeeHee

No as these are confirmed to be false positive detections.

 

They should be fixed with the most recent database update and no longer occur.

MBAM2 Version: v2018.11.03.08

MBAM3 Version: 1.0.7677

 

 

 

[robby_fr]

Hi,

Still one alarm for me (after update to 1.0.7677).

[Fatdcuk]

Hi robby_fr

MBAM2 Version: v2018.11.03.09

MBAM3 Version: 1.0.7679

Database just went live , please can you update and confirm the detections have stopped for you ?

Thanks in advance.

 

[robby_fr]

That's OK now with 1.0.7679. No alarm anymore.

Thanks

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks