Adobe Acrobat triggering false positives with Anti-Virus.

[Tyrone27602746bdcm]

Apologies if there's a thread on this already. I could not find anything using the search. Lately, our anti-virus has been popping off for random computers due to suspicious behavior of "behavior modification" from Adobe. We just about get 1-2 computers a day with this alert.  I saw an article on Bleeping Computer that Adobe is blocking anti-virus software from scanning PDFs. This is a huge security risk for us. Is there a workaround or fix for this? Here is a link to Bleeping Computer explaining the issue.

https://www.bleepingcomputer.com/news/security/adobe-acrobat-may-block-antivirus-tools-from-monitori...

[Krutikka D]

Hello @Tyrone27602746bdcm 

I hope you're doing great.

Thank you for sharing this with us.

We will indeed look into this and will get back to you with a definite response in a couple of days.

Thank you,

Krutikka

[Krutikka D]

Hello @Tyrone27602746bdcm 

Would you mind sharing a few details, so we can assist you better?

1. Application and OS version.

2. What is the exact error message you're getting? Please share a screenshot and video recording of the error and workflow you're doing.

3. Make and Model of the antivirus you're using.

Also, make sure that the antivirus is updated.

Hoping to hear from you soon.

Regards,

Krutikka

[Tyrone27602746bdcm]

1. Adobe Acrobat Reader Version 22.003.20282 / Windows 10 Pro 21H2

2. "Security Threat: Program Library Injection" seems to happen when users open a PDF I believe. I've attached a screenshot; PDF opens like normal for users, but we (IT) receive the suspicious behavior alert. It seems to happen to 1 or 2 random users daily at this point.

3. Trend Micro Worry Free Business Services Agent Version 6.7.3075/14.2.3048 Smart Scan Agent Pattern version: 18.143.00 (although it would have been whatever version was for 4 days ago as we have it automatically update daily)

[Krutikka D]

Hello @Tyrone27602746bdcm 

Hope you're doing well.

This issue might be internal. Would you mind checking whether bBlockDllInjection is present and set to 1 inside registry path SOFTWARE\Adobe\Acrobat Reader\DC\DLLInjection on the machines where this alert is coming up?

We are trying to reproduce and check on our end as well.

hoping to hear from you soon.

Regards,

Krutikka

[Tyrone27602746bdcm]

Sorry, I was out for the holidays.

I checked on my own computer, and the registry setting is set to 0. To my understanding, this is the correct setting as having it set to 0 will not block our anti-virus from scanning PDF files.

I was told by another coworker in IT that he read somewhere that the setting is set every time Adobe is opened and that on rare occasssions, Adobe will set it to 1 which triggers the problem.